Splunk Search

How to create a query for alerting two different events from the same host?

Splunk77
Explorer

I am working on a query to report on host/s that have triggered two different event types. For example windows event IDs 4697 and 4698, if triggered by the same host, rule must alert.

 

EventType =4697

EventType =4698

HostName=What is the best way to imply host name being unique to the eventtypes.

To further clarify, if the same host triggers 4697 and 4698 in a 5 minute window, I want to report on that. 

Thanks in advance.

Labels (1)
0 Karma

norbertt911
Communicator

index="windows_events" Eventtype=4697 OR Eventtype=4698 |stats count by Hostname

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...