How to create an alert based on the count of unique values for a field?

[m0ps]

Hello all!

I'm newbie in Splunk and I'm trying to figure out how to create an alert based on count of unique field values.

I have field src_mac and I need to trigger an alert each time the same value appears more than 4 times in search results.

Example log:

Apr 20 16:06:41 dhcp1 dhcpd: DHCPDISCOVER from a0:d3:c1:63:37:16 via 198.18.2.1: peer holds all free leases
dest_int = 198.18.2.1 dhcp_message = DHCPDISCOVER host = dhcp1 src_mac = a0:d3:c1:63:37:16
Apr 20 16:06:41 dhcp2 dhcpd: DHCPDISCOVER from a0:d3:c1:63:37:16 via 198.18.2.1: peer holds all free leases
dest_int = 198.18.2.1 dhcp_message = DHCPDISCOVER host = dhcp2 src_mac = a0:d3:c1:63:37:16
Apr 20 16:06:33 dhcp1 dhcpd: DHCPDISCOVER from a0:d3:c1:63:37:16 via 198.18.2.1: peer holds all free leases
dest_int = 198.18.2.1 dhcp_message = DHCPDISCOVER host = dhcp1 src_mac = a0:d3:c1:63:37:16
Apr 20 16:06:33 dhcp2 dhcpd: DHCPDISCOVER from a0:d3:c1:63:37:16 via 198.18.2.1: peer holds all free leases
dest_int = 198.18.2.1 dhcp_message = DHCPDISCOVER host = dhcp2 src_mac = a0:d3:c1:63:37:16
Apr 20 16:06:30 dhcp1 dhcpd: DHCPDISCOVER from a0:d3:c1:63:37:16 via 198.18.2.1: peer holds all free leases

Also I need to suppress results containing same field value for 10 minutes.
Could anybody provide example?

Thanks in advance,
Maxim

[PreetiKa]

Under Trigger Conditions->Trigger Alert When-> Number of Results -> is greater than -> "4" or whatever value you want to keep. And Supress Triggering for should be 600 seconds or 10minutes

[somesoni2 · Accepted solution]

How about this

your base search with required time range | stats count by src_mac | where count>4

[m0ps]

Yes, I've tried this, and it looks like works fine, but what about alert settings?

Is that correct?

[somesoni2]

If you want to get alert for a src_mac once per 10 min (if it's happening every 10 min), the the "Suppress triggering for" should be 10 mins (600 sec). Othere than that it looks good. May be update the Earliest and Latest to -5m@m and @m so that you capture the whole minute and don't loose data that to be considered.