Alerting

Alert for DHCP Broadcasts without acknowledgement

waJesu
Path Finder

I need help coming up with an alert for DHCP broadcasts with no acknowledgement.  The DHCP is injesting logs into Splunk.

Labels (1)

inventsekar
SplunkTrust
SplunkTrust

Hi @waJesu .. please provide us some more details.. do you use any splunkbase apps/addons, etc

or how do you configured DHCP to splunk integration.. are you referring to Splunk indexer to UF indexer acknowledgement feature or its related to DHCP?..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

waJesu
Path Finder

You know how a DHCP returns a DHCPACK after the other 3 steps (DHCPDISCOVER, DHCPOFFER, and DHCPREQUEST). From the logs, I want to identify events where a DHCP broadcast has no DHCPACK. I hope I have clarified my need. So far I have used: index=* host=<dhcp servername> "no free leases". I believe there is a better query and maybe narrow results by hostname.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...