I am trying to create a splunk alert for duplicate data and would like some help in creating the splunk search. The data looks something like this for a giving search time duration
Server Ping ID
ref0120 60 125gt
ref0125 53 456hy
ref0365 45 125gt
ref0012 32 526yu
The alert should look for the following:
1. If I get more than 1 event for the same ID in the specified duration, Trigger an alert
2. In our example, we have 2 events with the same ID '125gt'. I want an alert to be triggered when this happens.
Any help would be greatly appreciated!
Search for events and count them by ID. Eliminate those with a count of 1. If you get any results, trigger and alert.
<your search for events> | stats count, values(Server) as Server, values(Ping) as Ping by ID | where count > 1
Search for events and count them by ID. Eliminate those with a count of 1. If you get any results, trigger and alert.
<your search for events> | stats count, values(Server) as Server, values(Ping) as Ping by ID | where count > 1
This is awesome! I tested this and it works perfectly.
Thanks for your time!