Splunk Search

How to create a search for Splunk alerts for duplicate events?

wicke_s
Explorer

I am trying to create a splunk alert for duplicate data and would like some help in creating the splunk search. The data looks something like this for a giving search time duration

Server    Ping         ID
ref0120   60           125gt
ref0125   53           456hy
ref0365   45           125gt
ref0012   32           526yu

The alert should look for the following:
1. If I get more than 1 event for the same ID in the specified duration, Trigger an alert
2. In our example, we have 2 events with the same ID '125gt'. I want an alert to be triggered when this happens.

Any help would be greatly appreciated!

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Search for events and count them by ID. Eliminate those with a count of 1. If you get any results, trigger and alert.

<your search for events> | stats count, values(Server) as Server, values(Ping) as Ping by ID | where count > 1
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Search for events and count them by ID. Eliminate those with a count of 1. If you get any results, trigger and alert.

<your search for events> | stats count, values(Server) as Server, values(Ping) as Ping by ID | where count > 1
---
If this reply helps you, an upvote would be appreciated.

wicke_s
Explorer

This is awesome! I tested this and it works perfectly.

Thanks for your time!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...