Splunk Search

Need to exclude hosts which matched with event 4608 windows is starting up within 5 minutes

HPACHPANDE
Explorer


Below is the query which included all the events for windows shutdown and starting up 

want to exclude host when event 4608 is observed within 5 minutes

index =windows product=Windows
EventCode="4609" OR EventCode="4608" OR EventCode="6008"
| table _time name host dvc EventCode severity Message

please share the query.
Thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

So you are trying to exclude any event from a host if it has 4608 in the past 5 minutes.  Try

index =windows product=Windows
(EventCode="4609" OR EventCode="4608" OR EventCode="6008") NOT 
    [search index =windows product=Windows EventCode=4608 earliest=-5m
    | stats values(host) as host]
| table _time name host dvc EventCode severity Message

 

View solution in original post

Tags (1)

yuanliu
SplunkTrust
SplunkTrust

Do you mean something like this?

index =windows product=Windows
(EventCode="4609" OR EventCode="4608" OR EventCode="6008")
NOT (EventCode=4608 earliest=-5m)
| table _time name host dvc EventCode severity Message

 

0 Karma

HPACHPANDE
Explorer

HI @yuanliu ,


Thanks for sharing query on this matter.

 

Have reviewed your query concern is like you have excluded the windows starting up event within 5 minutes but it how it will consider the specific "host".

As per my understanding it should be host specific if single host got shutdown and got started up again within 5 minute should not trigger any alert.


0 Karma

yuanliu
SplunkTrust
SplunkTrust

So you are trying to exclude any event from a host if it has 4608 in the past 5 minutes.  Try

index =windows product=Windows
(EventCode="4609" OR EventCode="4608" OR EventCode="6008") NOT 
    [search index =windows product=Windows EventCode=4608 earliest=-5m
    | stats values(host) as host]
| table _time name host dvc EventCode severity Message

 

Tags (1)

gcusello
SplunkTrust
SplunkTrust

Hi @HPACHPANDE ,

please try something like this:

index =windows product=Windows
EventCode="4609" OR EventCode="6008" OR (EventCode="4608" AND _time<now()-300)
| table _time name host dvc EventCode severity Message

I'm not sure that it's possible to add the last condition in the main search, please try, if doesn't run, pleaase try this:

index =windows product=Windows
EventCode="4609" OR EventCode="4608" OR EventCode="6008"
| where EventCode="4608" AND _time<now()-300
| table _time name host dvc EventCode severity Message

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...