topic Re: Missing results in Splunk Alert Email in Alerting

Missing results in Splunk Alert Email

vdhiman63 — Thu, 28 Oct 2021 14:19:31 GMT

Hello Splunk Community !

I have an alert setup to report failed login attempts by a user > 4 times in 5 minutes.
Alert query :
index=win_os sourcetype="Security" EventCode=4625 | bin span=5m _time| stats count dc(user) by _time, user, Logon_Type,dest, src, Failure_Reason | where count > 3 | sort user | table _time, user, count, Logon_Type,dest, src, Failure_Reason

Alert settings:

Alert Type: Scheduled. Hourly, at 0 minutes past the hour.
Trigger Condition: Number of Results is > 0

Issue : the last time this alert ran, i got results only from 3 PM attempts.
the alert PDF did not report the results from 2:55 PM.

Actual Query result:

Alert PDF that came in email:

Any idea why the complete results were not shown from 2:55 PM when the alert triggered at the hour ?

Re: Missing results in Splunk Alert Email

somesoni2 — Thu, 28 Oct 2021 18:16:31 GMT

Check the scheduler logs (index=_internal sourcetype=scheduler savedsearch_name=YourAlertName) to confirm the number of result. Also, consider allowing some breathing space between the alert schedule and time range. Instead of using Basic schedule

Alert Type: Scheduled.

Run at Cron scheduleHourly: 3 * * * * (every hour at 3 min past the hour)

Time Range: -1h@h to @h (last full hour)
Trigger Condition: Number of Results is > 0

Re: Missing results in Splunk Alert Email

vdhiman63 — Fri, 29 Oct 2021 13:52:26 GMT

Thank you iam trying to check the logs. How can i verify the number of results in this message :

event_message
user=" ", app="search", savedsearch_name="Potential Brute Force Attack - 4 or more login attempts in 5 mins", status=delegated_remote_completion, scheduled_time=1635418800, member_guid=246-1311-453B-B4C8-727D1A, member_label="SH005", member_URI="https://10....", sid=scheduler__search__RMD57367c0d1d64e89d1_at_1635418800_55813_7EA1D246-1311-453B-B4C8-727D1A477CE1, success=1

Re: Missing results in Splunk Alert Email

somesoni2 — Fri, 29 Oct 2021 14:39:24 GMT

Search this and look for field result_count.

index=_internal sourcetype=scheduler status=success savedsearch_name="Potential Brute Force Attack - 4 or more login attempts in 5 mins"