Splunk Enterprise Security

Using the _time field for throttling within the correlation search.

AL3Z
Builder

Hi all,

In my AD computer account deletion correlation search, I use _time and subjectusername in throttling fields for grouping. Is adding _time to throttling the correct approach? Please correct me if I'm wrong.
query 
index=win sourcetype=XmlWinEventLog EventCode=4743
| bin _time span=5m
| stats values(EventCode) as EventCode, values(signature) as EventDescription, values(TargetUserName) as deleted_computer,  dc(TargetUserName) as computeruser_count by _time SubjectUserName
| where computeruser_count > 20
Time Range set to 
Earliest Time 20m@m
latest now
cron schedule */15 * * * *

Scheduling  set to Continuous

Throttling 
window duration 12 hours

Fields to group by SubjectUserName , _time

Thanks in Advance..

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Throttling works by checking to see if the specified field changed value within the throttle period.  Since _time is always changing it is ineffective as a throttle.

---
If this reply helps you, Karma would be appreciated.
0 Karma

AL3Z
Builder

@richgalloway ,

I need to change the query or its fine to drop the _time from the Throttling group by field name?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I would drop _time as a throttling field.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...