topic Re: Is there any way to send an email alert after a certain value? in Alerting

Is there any way to send an email alert after a certain value?

israalbo — Tue, 10 Mar 2020 15:33:45 GMT

I am displaying on a counter a value that basically counts the times a login has failed, but I would like to get an Email, every time that counter goes over 5, so that way I could monitor better what is going on or if it is an attack. Thank you!

Re: Is there any way to send an email alert after a certain value?

gcusello — Tue, 10 Mar 2020 15:50:16 GMT

HI @israalbo,
you can use the same search to schedule an alert.
You have only to define:

frequency of execution,
time period of search,
threshold.

In the alert you can also set if the alert must be fired every time there's a value that exceed threshold or if there's a period, after alert, that the alert isn't executed again.

Ciao.
Giuseppe

Re: Is there any way to send an email alert after a certain value?

israalbo — Tue, 10 Mar 2020 15:57:17 GMT

Hi, I am new at Splunk, let me get this straight, inside the search I can get a report by email? Do you have any extra information in order to accomplish that? I would be very thankful!

Re: Is there any way to send an email alert after a certain value?

gcusello — Tue, 10 Mar 2020 16:02:36 GMT

HI @israalbo,
you can create your search and when you have to save it, you can choose as options:

an alert,
a dashboard panel,
a report.

if you choose Alert, Splunk opens a panel to set the alert options (frequency, activation, etc...) and the actions (email, script execution, etc...).

For more infos see at:
https://www.youtube.com/watch?v=0REbozaALX0
https://docs.splunk.com/Documentation/Splunk/8.0.2/Alert/Aboutalerts

Ciao.
Giuseppe