topic Query for DHCP not returning acknowledgement in Alerting

Query for DHCP not returning acknowledgement

waJesu — Thu, 22 Oct 2020 19:33:30 GMT

I need to create an alert for when my DHCP server is not returning acknowledgement. Please help

Re: Query for DHCP not returning acknowledgement

richgalloway — Thu, 22 Oct 2020 20:19:09 GMT

Are you logging data from your DHCP server in Splunk? If so, see https://www.duanewaddle.com/proving-a-negative/. If not, then start onboarding DHCP info then read the information at the link above.

Re: Query for DHCP not returning acknowledgement

waJesu — Fri, 23 Oct 2020 10:24:41 GMT

Yeah the DHCP is bring logs into Splunk but I am specifically looking to create an alert for DHCP broadcasts with no acknowledgement. Please help along those lines. Thank you for the link. Though it doesn't have my solution, it is still helpful information to keep.

Re: Query for DHCP not returning acknowledgement

inventsekar — Fri, 23 Oct 2020 12:44:25 GMT

but I am specifically looking to create an alert for DHCP broadcasts with no acknowledgement//

Hi @waJesu i am not much sure of this.. but, let me ask, how to find out "DHCP broadcasts with no acknowledgement".. is it updated into some logs or you have some splunk search query?