Splunk Search

How to use events from last 30 minutes find duplicates from last 4 hours?

solaced
Explorer

Could someone help me with such a query? I am running a scheduled search every 30 minutes which aims to find duplicate registrations from the last 30 minutes, that were also used when compared to the last 4 hours.   

Since it runs search every 30 minutes, I cannot just search using a 4 hour window, else it will keep triggering an alert every 30 minutes for 4 hours basically. 

 

index=myindex userRegistration earliest=-4h latest=now

|stats count by dc(userName) as UserCount

| where UserCount>1

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @solaced,

you could try something like this:

index=myindex userRegistration earliest=-4h latest=now
| eval Period=if(now()-_time>1800,"Last 30 minutes","Other time")
| stats dc(Period) AS Period_count count by userName
| where Period_count>1

In this way you have only events present in both last 30 minutes and in before time, you don't have multiple events in the same period.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @solaced,

you could try something like this:

index=myindex userRegistration earliest=-4h latest=now
| eval Period=if(now()-_time>1800,"Last 30 minutes","Other time")
| stats dc(Period) AS Period_count count by userName
| where Period_count>1

In this way you have only events present in both last 30 minutes and in before time, you don't have multiple events in the same period.

Ciao.

Giuseppe

solaced
Explorer

Thank you so much!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @solaced ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated :winking_face:

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...