Splunk Search

search by specific condition within time range

hjwang
Contributor

Hello,i would like to search the specific ip attack events within the specific time range for real time,e.g. if the attack events of one IP are more than 5 times, splunk will send an alert. i use host="xxx" eventtype="specific_ip"| timechart span=1m count(SRC_IP) by SRC_IP, it can show the attack times table group by SRC_IP within each 1min time range, now how can i just pick the attack times more than 3 times, that is to say if there exists such one event(>=3), then spluck will send an alert?Thanks

Tags (1)
0 Karma

Michael_Wilde
Splunk Employee
Splunk Employee

instead of using "timechart" you might consider this..

host="xxx" eventtype="specific_ip" earliest=-1m@m| stats count by src_ip | where count >=3

This search says... in the last minute (on the minute) summarize the count events by src_ip, where any cell in the "count" column stats table is greater than or equal to three.

you also might schedule this search to run every minute. 3 failed logins is a rather simplistic search. You might consider looking at a successful login after three failed logins.

0 Karma

hjwang
Contributor

Thanks,Michael, if i use earliest command, the time's span can not be shown in search result table, only (src_ip, count). i wanna show like (_time, src_ip, count) but if i use timechart...| where count>=3, the search result table would not be displayed.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...