topic Re: i am looking for a particular string match in a log file. whenever it sees the String it should alert me with an email. in Splunk Search

i am looking for a particular string match in a log file. whenever it sees the String it should alert me with an email.

priyankamundarg — Tue, 02 Aug 2016 14:04:09 GMT

Kindly help me with crontab schedule and Trigger Conditions. Am confused in that part. If string matches what should be the trigger condition?

Re: i am looking for a particular string match in a log file. whenever it sees the String it should alert me with an email.

sundareshr — Tue, 02 Aug 2016 15:08:21 GMT

Create a search like this

index=yourindexname sourcetype=sourcetypename "matchingstringhere"

Save this as an alert. For schedule you can choose to run it at whatever frequency you would like. For trigger condition, choose "if number of events greater than" 0. For alert mode, select once.

Re: i am looking for a particular string match in a log file. whenever it sees the String it should alert me with an email.

hliakathali_spl — Thu, 04 Aug 2016 12:53:10 GMT

You can use particular event code or event description in search string, whenever if any violation happens or particular string match in a log file you will get an alert

Example: if account is locked out we will get an alert immediately by creating the alert by using below query,

index=winsec EventCodeDescription="A user account was locked out" OR E ventCode = 4740|dedup user| stats count by user _time host

Example for Crontab schedule:

The cron parameters, * * * * *, correspond to minute hour day month day-of-week.

*/5 * * * * Every 5 minutes.
*/30 * * * * Every 30 minutes.
0 */12 * * * Every 12 hours, on the hour.
*/20 * * * 1-5 Every 20 minutes, Monday through Friday.
0 9 1-7 * 1 First Monday of each month, at 9am.

Let me know if this is work out.