Could someone help me with such a query? I am running a scheduled search every 30 minutes which aims to find duplicate registrations from the last 30 minutes, that were also used when compared to the last 4 hours.
Since it runs search every 30 minutes, I cannot just search using a 4 hour window, else it will keep triggering an alert every 30 minutes for 4 hours basically.
index=myindex userRegistration earliest=-4h latest=now
|stats count by dc(userName) as UserCount
| where UserCount>1
Hi @solaced,
you could try something like this:
index=myindex userRegistration earliest=-4h latest=now
| eval Period=if(now()-_time>1800,"Last 30 minutes","Other time")
| stats dc(Period) AS Period_count count by userName
| where Period_count>1
In this way you have only events present in both last 30 minutes and in before time, you don't have multiple events in the same period.
Ciao.
Giuseppe
Hi @solaced,
you could try something like this:
index=myindex userRegistration earliest=-4h latest=now
| eval Period=if(now()-_time>1800,"Last 30 minutes","Other time")
| stats dc(Period) AS Period_count count by userName
| where Period_count>1
In this way you have only events present in both last 30 minutes and in before time, you don't have multiple events in the same period.
Ciao.
Giuseppe
Thank you so much!!
Hi @solaced ,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉