search help

[tkerr1357]

Hi All,

I am looking for a little help with a search today. I am looking to create an alert based on this search that only triggers when the same hostname comes up twice in a row. 

so far the search I have is I am unsure how to include/return two machines of the same name:

index="login_pi" source="WinEventLog:LoginPI Events" SourceName="Application Threshold Exceeded"
| rex field=_raw "Actual value\\\":\s+\\\"(?<actual_value>\d+)"
| search actual_value>=10
| table Target,actual_value,ApplicationName,Title

here is an example event:

07/14/2021 10:39:49 AM LogName=LoginPI Events EventCode=800 EventType=4 ComputerName=RNBSVSIMGT02.rightnetworks.com SourceName=Application Threshold Exceeded Type=Information RecordNumber=1786721 Keywords=Classic TaskCategory=None OpCode=Info Message={ "Description": "Measurement duration (7.561s) exceeded threshold of 5s (51.22%)", "Actual value": "7.561", "Threshold value": "5", "Measurement": "quickbooksopen_2021", "Locale": "English (United States)", "RemotingProtocol": "Rdp", "Resolution": "1920 × 1080", "ScaleFactor": "100%", "Target": "BPOQCP01S01", "TargetOS": "Microsoft Windows Server 2016 Standard 10.0.14393 (1607)", "AppExecutionId": "4ed43186-648c-4e8e-96ee-9e4b52e468cb", "AccountId": "a4a6655b-f7ac-4783-aec5-698a146eb2cf", "AccountName": "rightnetworks\\eloginpi082", "LauncherName": "RNBSVSI23", "EnvironmentName": "BPOQCP01S01", "EnvironmentId": "bc31c8f6-e8c0-4278-93c3-08d8040960f8", "ApplicationName": "QB_2021_Open", "ApplicationId": "ece9c6b9-6662-45be-970d-2708603ca13b", "Title": "Application threshold exceeded" }

[ITWhisperer · Accepted solution]

| streamstats values(ComputerName) as ComputerNameValues list(ComputerName) as ComputerNameList window=2
| where mvcount(ComputerNameValues) = 1 AND mvcount(ComputerNameList) = 2

[tkerr1357]

I changed it to target instead of computername but this did the trick.