Alerting

Alert when user is log off

ajromero
Path Finder

I need to get an alert when a user is log off from a server, here is my query

index="wineventlog" user="*.COM" OR user="*"
| head 1 | eval age = now() - _time
|table _time user name

Then I'm setting a custom alert to

ajromero_0-1623797502045.png

but I don't get any alert

Thank you,

 

 

 

Labels (2)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @ajromero I don't find age field in your table command, there could be other reasons.

  • age > 900 condition might not met, you can try same query in UI with | where age > 900 at the end exactly select time similar to schedule window. Lower age threshold and retry.
  • Your role/user assigned to these alerts to run alerts might not be having schedule search capability. You can run following query to find out what exactly happening with your search

 

index=_internal sourcetype="scheduler" savedsearch_name=<your_search_name>​

 

  • While configuring alert in UI ,Trigger Action under Alerts should be selected to Email and provide the correct email
  • could be issues while sending email to SMTP server , you can verify here. 

 

index=_internal source="/opt/splunk/var/log/splunk/python.log" subject="<your_email_subject>" sendemail ERROR​

 

----------

An upvote would be appreciated if it helps!

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ajromero 

Can you try this works? added age field to table command.

index="wineventlog" user="*.COM" OR user="*"
| head 1 | eval age = now() - _time
|table _time user name age

----

An upvote would be appreciated if it helps!

0 Karma

ajromero
Path Finder

Hi,

I already have the age field in the table and it doesn't do it

index="wineventlog" user="*.COM" OR user="*"
| head 1 | eval age = now() - _time
|table _time user name

 

thanks

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ajromero I don't find age field in your table command, there could be other reasons.

  • age > 900 condition might not met, you can try same query in UI with | where age > 900 at the end exactly select time similar to schedule window. Lower age threshold and retry.
  • Your role/user assigned to these alerts to run alerts might not be having schedule search capability. You can run following query to find out what exactly happening with your search

 

index=_internal sourcetype="scheduler" savedsearch_name=<your_search_name>​

 

  • While configuring alert in UI ,Trigger Action under Alerts should be selected to Email and provide the correct email
  • could be issues while sending email to SMTP server , you can verify here. 

 

index=_internal source="/opt/splunk/var/log/splunk/python.log" subject="<your_email_subject>" sendemail ERROR​

 

----------

An upvote would be appreciated if it helps!

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!