Splunk Enterprise Security

How to generate an event when a risk score above 100 is generated?

emmanuelpeter
New Member

So basically I'm trying to generate an event when a risk score above 100 is generated, I've come up with the below search string. Please, can you help me in identifying if anything needs to be changed?

| tstats allow_old_summaries=`allow_old_summaries_bool` sum(All_Risk.src) as src,from datamodel=Risk by All_Risk.src |  where risk_score>=100 | stats values(risk_score) by src

This is what my data model currently looks like.
alt text

0 Karma
1 Solution

deepashri_123
Motivator

Hey@emmanuelpeter,

If you are looking for events with risk_score>100 than you don't need to add stats.
Let me know if this helps!!
Thanks!!

View solution in original post

0 Karma

deepashri_123
Motivator

Hey@emmanuelpeter,

If you are looking for events with risk_score>100 than you don't need to add stats.
Let me know if this helps!!
Thanks!!

0 Karma

emmanuelpeter
New Member

Thanks Deepashri.

0 Karma

somesoni2
Revered Legend

Hey @emmanuelpeter,

I've converted @depashri_123's comment to an answer. If this has resolved your issue, please close the question by clicking on "Accept" button. This will help other Splunkers who might be having similar issues to know this works.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...