I need to create a baseline for what is common in an environment before creating a rule.
The rule can be as simple as:
search index=x sourcetype=y NOT [search index=x sourcetype=y earliest=-14d | table user]
The issue is doing an historical search using a simple search. I've looked a few commands including transaction and streamstats but did not manage to find a way to run this search recursively.
The basic idea is to find a rare value on a specific field that is only seen less than a set threshold (e.g. 10 events) during a 14 days windows.
Hi @Liran ,
please trey something like this:
index=x sourcetype=y
| eval period=if(_time>now()-864000,"last","previous")
| stats count BY period
| search period="last" count<10
in this way you tag the events in two categories: "last" (Last 10 days) and "previous".
Then you have events if in the last period there are less than a threshold (10 events).
ciao.
Giuseppe
Not sure what the question is here - please can you clarify / expand?