Hi,
I have a Splunk search which detect some potential attack Ips.
The alert scheduled every 4 hours and detect the offending IPs for last 24 hour which tried to login but failed for multiple times.
The result could be something like the following example:
ip failed_count
123.456.789.123 100
222.333.544.111 200
The problem is that, let's say the alert triggered at 8:00 am for the above result.
At 12:00 am, the alert triggered again with the following result:
ip failed_count
123.456.789.123 100
222.333.544.111 200
444.555.666.777 220
How could i exclude the previous result which already existing and only put the new one?
What i need for the alert at 12:00 am is only show:
ip failed_count
444.555.666.777 220
I tried to use Throttle to suppress results containing field value of ip, but this only works as per result, which means i would got multiple emails.
Please help, thanks in advance !
... View more