Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to look for events within a specified time period?

$
0
0
Thx to @richgalloway he provided me the way forward on returning raw events in table format after a search with eventstats: index=foo | dedup src | iplocation src | eventstats count by _time City src user | sort -count | stats values(City) as City, dc(City) as City_Count, values(src) as IP, sum(count) as Total by user | where City_Count > 3 | sort -Total Now my question is how do I search for a specified time period, like say five minutes? This search would help me potentially find compromised accounts as I basing it on X amount of logins within Y time Thx

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>