Hi, splunkers.
I need to generate an alert when more than 10 events related to the same camera are generated in 1 hour. I have tried with count and other commands but it has not been possible.
the examples of events are:
[2019-06-03 01:22:40] Cámara CAM004: La cámara esta presentando problemas {"Workstation":"192.168.10.2","Camara":"172.16.8.12","estadoSeñal":"Camera Connection Status(Lost)"}.
When a camera fails, they are presented around 20 events in a time range of one hour.
Hi @josedgaravito ,
You could try this as well:
... [ your base search ] ... earliest=-1h
| rex "Cámara (?<camara>[^:]+):"
| stats count by camara
| where count > 10
This should show results for camara having more than 10 events in the time frame specified.
@josedgaravito What is the field name for Camera, do you need to extract the fields or are they already extracted? How does your search query look.
It has no name, they differ by the IP, the field of the camera is IPCamara
@josedgaravito
<your search>|bin _time span=1h | stats count by IPCamera _time| where count > 10
Hola @josedgaravito,
I see what you want to do, have a look here, should be a very similar solution :
https://answers.splunk.com/answers/751158/how-to-find-out-falied-login-attemptseventcode4625-1.html#...
Your query should be something like this :
yourBaseSearch
| bin _time span=1h
| stats count by cameraID,_time
| where count > 10
Let me know if you need more help.
Cheers,
David