Highlight Repeat Notable Offenders

[kmcaloon]

I'm trying to write a search to highlight users that have caused multiple notables over time. Using the search below, I can get a list of which users created notables each day. I'd like to modify the search to show users that have notables in more than one day period over the past 30 days. i.e. UserA created a notable on the 1st and the 2nd. Basically looking for repeat offenders. Any ideas?

notable | search NOT suppression |timechart count by user usenull=f useother=f

[Splunker]

Im sure you have a specific use-case in mind but have you seen the "Risk Activity" dashboard in ES?

Repeat offenders tally up a score so they bubble up to the top when the risk is high enough from the total score.

The risk score is also dotted throughout ES making it easy to see.

Just in case you havent come across it is all.

Cheers.

[kmcaloon]

I think I answered my own question. It's sort of a weird way to get the info, but I think this is accurate.

notable | search NOT suppression AND NOT rule_title=VPN |eval mytime=strftime(_time, "%Y%m%d") | makemv delim=" " user | mvexpand user |eval user=lower(user)| stats values(mytime) as Dates by user | stats count(Dates) as Number by user | where Number>=2 | rename Number as "Number of Days"| sort - "Number of Days"

[kmcaloon]

Getting closer, but still not seeing repeats.

notable | search NOT suppression |eval mytime=strftime(_time, "%Y%m%d")| makemv delim=" " user | mvexpand user |chart count(mytime) by user usenull=f useother=f