Splunk Search

How to create a query for alerting two different events from the same host?

Splunk77
Explorer

I am working on a query to report on host/s that have triggered two different event types. For example windows event IDs 4697 and 4698, if triggered by the same host, rule must alert.

 

EventType =4697

EventType =4698

HostName=What is the best way to imply host name being unique to the eventtypes.

To further clarify, if the same host triggers 4697 and 4698 in a 5 minute window, I want to report on that. 

Thanks in advance.

Labels (1)
0 Karma

norbertt911
Path Finder

index="windows_events" Eventtype=4697 OR Eventtype=4698 |stats count by Hostname

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...