topic Re: Is any way to include logs/events in Alert email? in Alerting

Is any way to include logs/events in Alert email?

summerura — Thu, 28 Nov 2019 14:56:19 GMT

Hi Splunkers!

i set the alert with "upload". which means someone upload something, i get email.
The email is only included last event. But i want to get email with a few previous events.

for example, if logs are like this

[date:02.08.2019] [user:haha] [c:login]
[date:02.08.2019] [user:haha] [c:download]
[date:02.08.2019] [user:haha] [c:edit]
[date:02.08.2019] [user:haha] [c:upload]

i got email only with last line which is "[date:02.08.2019] [user:haha] [c:upload]".
But i want to get alert email not only event but also previous events.
which is "[date:02.08.2019] [user:haha] [c:edit], [date:02.08.2019] [user:haha] [c:upload] " or even last 3 events.

is it possible?

Thanks for reading

Re: Is any way to include logs/events in Alert email?

woodcock — Fri, 29 Nov 2019 22:11:52 GMT

You can setup the alert to send all events and then end your alerting search SPL with ... | head 5

Re: Is any way to include logs/events in Alert email?

summerura — Tue, 03 Dec 2019 13:38:40 GMT

makes sense. Thanks, but how can I call all events?

Re: Is any way to include logs/events in Alert email?

summerura — Tue, 03 Dec 2019 13:54:55 GMT

I tried

host="blahblah" AND c=upload AND sourcetype="blahblah"

| head 5

but it's nor working

Re: Is any way to include logs/events in Alert email?

woodcock — Tue, 03 Dec 2019 16:04:42 GMT

Put your threshold into the SPL like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="blahblah" AND host="blahblah" AND c=upload
| eventstats count(or other aggregation function here) AS trigger BY host and/or maybe other fields here
| where trigger > YourThresholdHere

Then set your alert for Number of events and Is greater than 0 and click the boxes to include all events.

Re: Is any way to include logs/events in Alert email?

woodcock — Fri, 13 Dec 2019 11:46:07 GMT

Everybody is very confused at this point. You should probably back ALL the way up and start over. What do your events look like? What is your search SPL? What are your alert settings?

Re: Is any way to include logs/events in Alert email?

summerura — Wed, 30 Sep 2020 03:58:05 GMT

Hi, @woodcock
Thanks for help!

i think we understood wrong eachother. i want to explain again...

We have "audit_log" from our software in splunk and the data are updated every second.
There are sometimes log-in error if somebody give wrong password or when the server has problem.
and we set the email-alert when somebody have log-in error.
BUT we want to also include the last audit_log line in email-alert.
My question was whether it is possible or not...
Do you have any idea?

Thanks