I am looking for a little help with a search today. I am looking to create an alert based on this search that only triggers when the same hostname comes up twice in a row.
so far the search I have is I am unsure how to include/return two machines of the same name:
index="login_pi" source="WinEventLog:LoginPI Events" SourceName="Application Threshold Exceeded"| rex field=_raw "Actual value\\\":\s+\\\"(?<actual_value>\d+)"| search actual_value>=10| table Target,actual_value,ApplicationName,Title
here is an example event:
| streamstats values(ComputerName) as ComputerNameValues list(ComputerName) as ComputerNameList window=2
| where mvcount(ComputerNameValues) = 1 AND mvcount(ComputerNameList) = 2
View solution in original post
I changed it to target instead of computername but this did the trick.