Splunk Search

Detecting suspicious activity in search * See examples.

omgwut56k
Path Finder

I need to be able to detect this pattern of events, in a series of events where the TERMINAL number is increasing by 1 and eventually has a status of 'S', in other words, I need to be detect the event(s) that have a status of 'S' where the preceding 5 events were increasing by 1 and had a status of 'F'.

Thank you

_time TERMINAL DLDTYPE STATUS

2015-02-10T15:29:21.000-0500 1759512 U F
2015-02-10T15:29:31.000-0500 1759513 U F
2015-02-10T15:29:42.000-0500 1759514 U F
2015-02-10T15:30:17.000-0500 1759515 F S
2015-02-10T15:32:20.000-0500 1759516 F S

2015-02-10T15:33:31.000-0500 1759517 U F
2015-02-10T15:34:42.000-0500 1759518 U F

Tags (3)
0 Karma
1 Solution

omgwut56k
Path Finder

This seems to be working so far

| delta TERMID AS delta | table _time TERMINAL delta STATUS MESSAGE | search delta="-1" STATUS=S

View solution in original post

0 Karma

omgwut56k
Path Finder

This seems to be working so far

| delta TERMID AS delta | table _time TERMINAL delta STATUS MESSAGE | search delta="-1" STATUS=S

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...