https://community.splunk.com/t5/Splunk-Search/How-to-create-and-trigger-an-alert-when-specific-Active/m-p/258423#M77420 <P>Create a lookup table for the csv file you have. The csv file should have a column name same as the field in event log with user id. I assume it is Account_Name.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Addfieldsfromexternaldatasources">http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Addfieldsfromexternaldatasources</A></P> <P>Then a query like this should give you the alert</P> <PRE><CODE>index=windowslogs EventId=4740 [|inputlookup userlist.csv | table Account_Name] </CODE></PRE> <P>Setup an alert if count&gt;0</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Aboutalerts">http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Aboutalerts</A></P> Tue, 12 Jul 2016 22:04:16 GMT sundareshr 2016-07-12T22:04:16Z https://community.splunk.com/t5/Splunk-Search/How-to-create-and-trigger-an-alert-when-specific-Active/m-p/258421#M77418 <P>I have one CSV file containing important user names. I want to create an alert/correlation rule whenever the user from that specific list get locked out.</P> Tue, 12 Jul 2016 19:50:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-and-trigger-an-alert-when-specific-Active/m-p/258421#M77418 rashid47010 2016-07-12T19:50:07Z https://community.splunk.com/t5/Splunk-Search/How-to-create-and-trigger-an-alert-when-specific-Active/m-p/258422#M77419 <P>To achieve that you should create a lookup. A lookup will compare a field from a file and add some data to your current data indexed in splunk. Your csv should have at least the username field and another field, for exemple vip=yes. With that you will compare logs from AD and lookup them and find if a user is vip or not.<BR /> You can find more information on: <A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Addfieldsfromexternaldatasources">http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Addfieldsfromexternaldatasources</A></P> Tue, 12 Jul 2016 20:25:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-and-trigger-an-alert-when-specific-Active/m-p/258422#M77419 gfreitas 2016-07-12T20:25:29Z https://community.splunk.com/t5/Splunk-Search/How-to-create-and-trigger-an-alert-when-specific-Active/m-p/258423#M77420 <P>Create a lookup table for the csv file you have. The csv file should have a column name same as the field in event log with user id. I assume it is Account_Name.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Addfieldsfromexternaldatasources">http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Addfieldsfromexternaldatasources</A></P> <P>Then a query like this should give you the alert</P> <PRE><CODE>index=windowslogs EventId=4740 [|inputlookup userlist.csv | table Account_Name] </CODE></PRE> <P>Setup an alert if count&gt;0</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Aboutalerts">http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Aboutalerts</A></P> Tue, 12 Jul 2016 22:04:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-and-trigger-an-alert-when-specific-Active/m-p/258423#M77420 sundareshr 2016-07-12T22:04:16Z