https://community.splunk.com/t5/Reporting/Splunk-Notification-for-Cisco-ISE-account/m-p/513466#M8329 <P>Hello</P><P>I'm using splunk to send notifications when cisco vpn account connect</P><P>now I have to add each account to rule</P><P>if I want to configure rule when the user contains specific word then splunk send notification how can I do that?</P><P>now I'm using&nbsp;</P><P>Device IP Address= x.x.x.x Passed Authentications<BR />UserName="firstname1.lastname1.vpn" OR "firstname2.lastname2.vpn"&nbsp;<BR />| stats values(UserName) as user by UserName | table UserName</P><P>vpn attribute is common between users so I want to check if any account.vpn connected then splunk run rule and send me email notification</P><P>&nbsp;</P> Mon, 10 Aug 2020 23:30:06 GMT skhanfar 2020-08-10T23:30:06Z https://community.splunk.com/t5/Reporting/Splunk-Notification-for-Cisco-ISE-account/m-p/513466#M8329 <P>Hello</P><P>I'm using splunk to send notifications when cisco vpn account connect</P><P>now I have to add each account to rule</P><P>if I want to configure rule when the user contains specific word then splunk send notification how can I do that?</P><P>now I'm using&nbsp;</P><P>Device IP Address= x.x.x.x Passed Authentications<BR />UserName="firstname1.lastname1.vpn" OR "firstname2.lastname2.vpn"&nbsp;<BR />| stats values(UserName) as user by UserName | table UserName</P><P>vpn attribute is common between users so I want to check if any account.vpn connected then splunk run rule and send me email notification</P><P>&nbsp;</P> Mon, 10 Aug 2020 23:30:06 GMT https://community.splunk.com/t5/Reporting/Splunk-Notification-for-Cisco-ISE-account/m-p/513466#M8329 skhanfar 2020-08-10T23:30:06Z