Splunk Search

How to achieve eval expression using the usecase in Splunk?

AL3Z
Builder

Hi,
I'm trying to write the spl query on  usecase like  alertname!="*pdm*"  triggerred by user in between like 2 hours how could we achieve using it eval expression.

Labels (4)
0 Karma

woodcock
Esteemed Legend

index="YouShouldAlwaysSpecifyYourIndex" AND sourcetype="AndYourSourcetypeToo" AND alertname!="*pdm*" 
| streamstats time_window=2h count by alertname user
| where count>3

0 Karma

tscroggins
Influencer

Hi,

To find events over the last two hours, use a search similar to the following:

index=foo alertname!="*pdm*" earliest_time=-2h latest_time=now

To find multiple occurrences of events by user in a rolling two hour window, schedule an hourly search similar to the following:

index=foo alertname!="*pdm*" earliest_time=-2h@h latest_time=@h
| eventstats count by alertname user
| where count>1

To increase the frequency of detection, change the schedule and snap the time values to the same interval. For example, to search a rolling 2 hour window every minute:

index=foo alertname!="*pdm*" earliest_time=-2h@m latest_time=@m
| eventstats count by alertname user
| where count>1

You may need to modify your scheduled search settings relative to indexing and scheduling lag in your environment or alternatively, loosen your earliest_time and latest_time predicates and use _index_earliest and _index_latest to constrain the event window. More information on time modifiers is available at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Searchtimemodifiers.

Is there a more complex problem you're trying to solve?

0 Karma

AL3Z
Builder

@tscroggins 

Hi,

My usecase is of in between 2 hours if users triggers an alert other than pdm more than 3 times !

0 Karma

tscroggins
Influencer

If your alerts are triggered no more frequently than once per minute, the last example should work with an adjusted threshold:

index=foo alertname!="*pdm*" earliest_time=-2h@m latest_time=@m
| eventstats count by alertname user
| where count>3

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...