Search Chain

[phillipmadm]

Hopefully this is an easy one.
We have an alert setup that notifies us if a specific error occurs more than 30 times in 1 minute. It works and gives us a nice little report of the hit count. Since this report is a mass disconnect alert, it was based on the quantity of termination messages. We now need to notify the users associated with the mass disconnect. Username field is available in the source messages but I'm having an issue chaining the logic together.

Base alert below.
index=security source="application.log" application_message=termination| bucket _time span=1m | stats count by _time | WHERE count > 30

[DalJeanis · Accepted solution]

index=security source="application.log" application_message=termination
| bucket _time span=1m 
| stats count as termCount, values(username) as username by _time 
| WHERE termCount > 30 

The result will be a multivalue field with each username in it.

If you wanted to break out the field again for individual notification, then use

| mvexpand username

[phillipmadm]

Worked like a charm.
Thanks