How to use events from last 30 minutes find duplicates from last 4 hours?

[solaced]

Could someone help me with such a query? I am running a scheduled search every 30 minutes which aims to find duplicate registrations from the last 30 minutes, that were also used when compared to the last 4 hours.   

Since it runs search every 30 minutes, I cannot just search using a 4 hour window, else it will keep triggering an alert every 30 minutes for 4 hours basically. 

index=myindex userRegistration earliest=-4h latest=now

|stats count by dc(userName) as UserCount

| where UserCount>1

[gcusello · Accepted solution]

Hi @solaced,

you could try something like this:

index=myindex userRegistration earliest=-4h latest=now
| eval Period=if(now()-_time>1800,"Last 30 minutes","Other time")
| stats dc(Period) AS Period_count count by userName
| where Period_count>1

In this way you have only events present in both last 30 minutes and in before time, you don't have multiple events in the same period.

Ciao.

Giuseppe

[solaced]

Thank you so much!!

[gcusello]

Hi @solaced ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉