topic Re: RSA_Probe_Alert_RSA_SECUREID_null_Splunk will check every min for the events with key word "svc_radius_probe_ct in Alerting

RSA_Probe_Alert_RSA_SECUREID_null_Splunk will check every min for the events with key word "svc_radius_probe_ctx"

SUBHRAJIT93 — Mon, 08 Apr 2024 05:12:43 GMT

how to resolve the repetitive alert of RSA_Probe_Alert_RSA_SECUREID_null_Splunk will check every min for the events with key word "svc_radius_probe_ctx" and when there is no events with the key word found for that min alert will be triggered. all the vms and server is working fine. every week atleast once getting this alert.

Re: RSA_Probe_Alert_RSA_SECUREID_null_Splunk will check every min for the events with key word "svc_radius_probe_ct

ITWhisperer — Mon, 08 Apr 2024 06:18:10 GMT

Are you saying that you are getting false alerts i.e. when you look back at the minute that was alerted on, there are "svc_radius_probe_ctx" events?

If so, this could be that they have not been indexed by the time the alert report is executed, i.e. you have not left enough time between the event happening, and it being sent to Splunk, and it being indexed. There is (nearly) always a lag between the event time (_time) and the index time (_indextime), and your alert report schedule and time period should take this into account.

Re: RSA_Probe_Alert_RSA_SECUREID_null_Splunk will check every min for the events with key word "svc_radius_probe_ct

SUBHRAJIT93 — Mon, 08 Apr 2024 06:22:41 GMT

As per my investigation the minute that was alerted on, there are "svc_radius_probe_ctx" events occurred. what type of changes I should make to resolve it ? should I increase the time ? or is there anything need to be done from RSA console ?

Re: RSA_Probe_Alert_RSA_SECUREID_null_Splunk will check every min for the events with key word "svc_radius_probe_ct

ITWhisperer — Mon, 08 Apr 2024 09:08:38 GMT

You need to investigate your settings for your report and determine why you are missing alerts.