Splunk Enterprise Security

I am searching for a query

matthiascarlier
Engager

I am new to Splunk (Enterprise Security) and I am stuck on making a certain correlation search.

An example of the events I get:

1) 1/1/2018 12:00:00 | voltage=200
2) 1/1/2018 12:00:01 | voltage=400
3) 1/1/2018 12:00:02 | voltage=200
4) 1/1/2018 12:00:03 | voltage=200

Is it possible to get the events in a range of 1 second of each other where the difference in voltage is more than 100?

So what I mean is that I need for every combination of 1 second a control that the difference is more than 100.
So the result needs to be:
- event 1: difference between 1 and 2 in voltage is more than 100
- event 2: difference between 2 and 3 in voltage is more than 100

Can someone help me with this? I have no clue how to solve this one...
Many thanks!

0 Karma
1 Solution

DalJeanis
Legend

This assumes that your readings are ALWAYS every 1 second and you just mean successive readings with voltage difference more than 100.

    your current search giving above results
   | streamstats current=t window=2 range(voltage) as voltage_difference
   | reverse
   | streamstats current=f window=1 last(voltage_difference) as voltage_difference2
   | where (voltage_difference > 100) OR (voltage_difference2 > 100)
   | reverse

This assumes that your readings may happen at other intervals and you are only interested in those that are within 1 second of each other with voltage difference more than 100.

    your current search giving above results
   | streamstats current=t time_window=1s range(voltage) as voltage_difference
   | reverse
   | streamstats current=t time_window=1s range(voltage) as voltage_difference2
   | where (voltage_difference > 100) OR (voltage_difference2 > 100)
   | reverse

View solution in original post

matthiascarlier
Engager

Thanks for the answers!

Now I have another question following on the previous one:
How can I make it that way, an event is triggered when this event happens X times over 10 seconds for example?

0 Karma

DalJeanis
Legend

This assumes that your readings are ALWAYS every 1 second and you just mean successive readings with voltage difference more than 100.

    your current search giving above results
   | streamstats current=t window=2 range(voltage) as voltage_difference
   | reverse
   | streamstats current=f window=1 last(voltage_difference) as voltage_difference2
   | where (voltage_difference > 100) OR (voltage_difference2 > 100)
   | reverse

This assumes that your readings may happen at other intervals and you are only interested in those that are within 1 second of each other with voltage difference more than 100.

    your current search giving above results
   | streamstats current=t time_window=1s range(voltage) as voltage_difference
   | reverse
   | streamstats current=t time_window=1s range(voltage) as voltage_difference2
   | where (voltage_difference > 100) OR (voltage_difference2 > 100)
   | reverse

woodcock
Esteemed Legend

Here are a couple of different ways, all starting with this to generate fake event data:

|makeresults
| eval raw="1/1/2018 12:00:00 | voltage=200:::1/1/2018 12:00:01 | voltage=400:::1/1/2018 12:00:02 | voltage=200:::1/1/2018 12:00:03 | voltage=200"
| makemv delim=":::" raw
| mvexpand raw
| rename raw AS _raw
| eval _time=strptime(_raw, "%m/%d/%Y %H:%M:%S")
| rex "voltage=(?<voltage>\d+)"
| streamstats count AS SERIAL

Here is one way:

| reverse
| streamstats time_window=2 range(voltage) AS voltage_span
| search voltage_span>100
| reverse

Here is another way that presumes you have exactly 1 measure/second:

| reverse
| autoregress voltage AS prev_voltage
| where abs(voltage - prev_voltage) > 100
| reverse

And yet another way that presumes you have exactly 1 measure/second:

| reverse
| streamstats current=f window=1 last(voltage) as prev_voltage
| where abs(voltage - prev_voltage) > 100
| reverse
0 Karma

somesoni2
Revered Legend

Give this a try

your current search giving above results
| streamstats current=f window=1 values(voltage) as prev_voltage
| where abs(prev_voltage-voltage)>100
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...