topic Re: Alert when user is log off in Alerting

Alert when user is log off

ajromero — Tue, 15 Jun 2021 22:53:15 GMT

I need to get an alert when a user is log off from a server, here is my query

index="wineventlog" user="*.COM" OR user="*"
| head 1 | eval age = now() - _time
|table _time user name

Then I'm setting a custom alert to

but I don't get any alert

Thank you,

venkatasri — Wed, 16 Jun 2021 00:25:35 GMT

Can you try this works? added age field to table command.

index="wineventlog" user="*.COM" OR user="*" | head 1 | eval age = now() - _time |table _time user name age

----

An upvote would be appreciated if it helps!

ajromero — Thu, 17 Jun 2021 14:51:27 GMT

Hi,

I already have the age field in the table and it doesn't do it

index="wineventlog" user="*.COM" OR user="*"
| head 1 | eval age = now() - _time
|table _time user name

thanks

venkatasri — Fri, 18 Jun 2021 01:54:15 GMT

Hi @ajromero I don't find age field in your table command, there could be other reasons.

age > 900 condition might not met, you can try same query in UI with | where age > 900 at the end exactly select time similar to schedule window. Lower age threshold and retry.
Your role/user assigned to these alerts to run alerts might not be having schedule search capability. You can run following query to find out what exactly happening with your search

index=_internal sourcetype="scheduler" savedsearch_name=<your_search_name>

While configuring alert in UI ,Trigger Action under Alerts should be selected to Email and provide the correct email
could be issues while sending email to SMTP server , you can verify here.

index=_internal source="/opt/splunk/var/log/splunk/python.log" subject="<your_email_subject>" sendemail ERROR

----------

An upvote would be appreciated if it helps!