https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243398#M4530 <P>The query looks fine. What is the specific problem you are having with scheduling the alert?</P> Thu, 19 Jan 2017 13:20:36 GMT richgalloway 2017-01-19T13:20:36Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243397#M4529 <P>Hi,</P> <P>i'm trying to set an alert that will notify me through mail with the name of accounts which have failed authentications more than some number. <BR /> The result of search must be only for active day, not for 24 hour period. I think that the search is all right but i have problem with scheduling mail alert.</P> <P>Search looks like this...</P> <PRE><CODE>index=windows_ad source="wineventlog:security" earliest=@d latest=now ("EventCode=675" OR ("EventCode=672" AND Type="Failure Audit")) OR (EventCode=4771 AND "Audit Failure") NOT (User_Name="*$" OR Account_Name="*$") NOT Failure_Code=0x19 | eval "User Account"=coalesce(User_Name,Account_Name) | stats count by "User Account" | where count &gt; 100 | sort - count </CODE></PRE> <P>Can you please help me with scheduling mail step by step? I tried with real-time triggering, schedule triggering, throttle but i didn't receive any mail.</P> <P>Thank you!</P> Thu, 19 Jan 2017 12:03:01 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243397#M4529 aanic 2017-01-19T12:03:01Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243398#M4530 <P>The query looks fine. What is the specific problem you are having with scheduling the alert?</P> Thu, 19 Jan 2017 13:20:36 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243398#M4530 richgalloway 2017-01-19T13:20:36Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243399#M4531 <P>I want to recive mail notification whith every new line of resultat (name of account) of that querry . I was trying with few schedule methods but it didnt work fine. Can you please help me about this, i cant find correct configuration of "Alert type and Trigger condition" in Alert section.</P> Thu, 19 Jan 2017 14:35:48 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243399#M4531 aanic 2017-01-19T14:35:48Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243400#M4532 <P>Hi aanic, </P> <P>You need to configure email alert notifications. Please refer to step-by-step instructions in the documentation: </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/Emailnotification">http://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/Emailnotification</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/Setupalertactions">http://docs.splunk.com/Documentation/Splunk/6.5.1/Alert/Setupalertactions</A></P> <P>Hope this helps. Thanks! <BR /> Hunter</P> Thu, 19 Jan 2017 15:01:16 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243400#M4532 hunters_splunk 2017-01-19T15:01:16Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243401#M4533 <P>I read that instructions, set email notificatin, schedule triger but it didnt works. Here is some of my attempts...</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2340iE71295E7E82E5915/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2341i3662A9BC5B238938/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 19 Jan 2017 15:08:25 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243401#M4533 aanic 2017-01-19T15:08:25Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243402#M4534 <P>Make sure that you click on <CODE>+ Add Actions</CODE> and select <CODE>Add to Triggered Alerts</CODE>. If you see an alert in the <CODE>Activity</CODE> -&gt; <CODE>Triggered Alerts</CODE> area, then you know the problem is that email settings are not right so email is the problem. If you do not see a triggered alert, then turn off throttling. If you still do not see a triggered alert, then try to pull up the search output of the last scheduled run to see if your search is finding what it should with <CODE>| loadjob savedsearch="YourUser:YourApp:YourSavedSearch"</CODE>. Somewhere in that quest you will find the problem.</P> Fri, 20 Jan 2017 06:12:33 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243402#M4534 woodcock 2017-01-20T06:12:33Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243403#M4535 <P>I set all that, but i didn't recive any mail. <BR /> Here is configuration of my alert. Can somebody send me photo with correct configuration i would be grateful. </P> <P>Thx!</P> <P>Augustin</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2343i4F50DA1316BEE4AA/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2344i4444B35E035C6EC1/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 20 Jan 2017 09:48:44 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243403#M4535 aanic 2017-01-20T09:48:44Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243404#M4536 <P>Now it works. I just clone that qouerry in new one and now it works well.</P> <P>Thank you all for support!</P> <P>Augustin</P> Fri, 20 Jan 2017 14:54:27 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243404#M4536 aanic 2017-01-20T14:54:27Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243405#M4537 <P>Please accept one of the offered solutions.</P> Fri, 20 Jan 2017 16:33:42 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243405#M4537 richgalloway 2017-01-20T16:33:42Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243406#M4538 <P>@aanic - To add to rich's comment, please don't forget to click "Accept" below the best answer to resolve this post so it can be easily found by other users. Don’t forget to upvote anything that was helpful too. Thanks!</P> Mon, 23 Jan 2017 03:19:27 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243406#M4538 aaraneta_splunk 2017-01-23T03:19:27Z https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243407#M4539 <P>Run this search:</P> <PRE><CODE>index=_internal sourcetype=splunk_python </CODE></PRE> <P>You are looking for errors like this:</P> <PRE><CODE>ERROR sendemail:417 - [Errno 111] Connection refused while sending mail to: woodcock@splunxter.com host = YourSearchHead source = /opt/splunk/var/log/splunk/python.log sourcetype = splunk_python ERROR sendemail:131 - Sending email. subject="Splunk Alert: AntiHack: Block IPs with 10 auth failures in 5 minutes", results_link="http://YourSearchHead.com:8000/app/AntiHack/@go?sid=scheduler__nobody__AntiHack__RMD5e3bf059b79d736d6_at_1485189540_73", recipients="[u'woodcock@splunxter.com']", server="localhost" host = YourSearchHead source = /opt/splunk/var/log/splunk/python.log sourcetype = splunk_python </CODE></PRE> <P>This tells you that your email settings are bad.</P> <P>Have you configured <CODE>Settings</CODE> -&gt; <CODE>Server settings</CODE> -&gt; <CODE>Email settings</CODE> ?</P> Mon, 23 Jan 2017 16:59:40 GMT https://community.splunk.com/t5/Alerting/How-to-configure-an-alert-to-email-me-results-of-failed/m-p/243407#M4539 woodcock 2017-01-23T16:59:40Z