Alerting

Alert when user is log off

ajromero
Path Finder

I need to get an alert when a user is log off from a server, here is my query

index="wineventlog" user="*.COM" OR user="*"
| head 1 | eval age = now() - _time
|table _time user name

Then I'm setting a custom alert to

ajromero_0-1623797502045.png

but I don't get any alert

Thank you,

 

 

 

Labels (2)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @ajromero I don't find age field in your table command, there could be other reasons.

  • age > 900 condition might not met, you can try same query in UI with | where age > 900 at the end exactly select time similar to schedule window. Lower age threshold and retry.
  • Your role/user assigned to these alerts to run alerts might not be having schedule search capability. You can run following query to find out what exactly happening with your search

 

index=_internal sourcetype="scheduler" savedsearch_name=<your_search_name>​

 

  • While configuring alert in UI ,Trigger Action under Alerts should be selected to Email and provide the correct email
  • could be issues while sending email to SMTP server , you can verify here. 

 

index=_internal source="/opt/splunk/var/log/splunk/python.log" subject="<your_email_subject>" sendemail ERROR​

 

----------

An upvote would be appreciated if it helps!

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ajromero 

Can you try this works? added age field to table command.

index="wineventlog" user="*.COM" OR user="*"
| head 1 | eval age = now() - _time
|table _time user name age

----

An upvote would be appreciated if it helps!

0 Karma

ajromero
Path Finder

Hi,

I already have the age field in the table and it doesn't do it

index="wineventlog" user="*.COM" OR user="*"
| head 1 | eval age = now() - _time
|table _time user name

 

thanks

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ajromero I don't find age field in your table command, there could be other reasons.

  • age > 900 condition might not met, you can try same query in UI with | where age > 900 at the end exactly select time similar to schedule window. Lower age threshold and retry.
  • Your role/user assigned to these alerts to run alerts might not be having schedule search capability. You can run following query to find out what exactly happening with your search

 

index=_internal sourcetype="scheduler" savedsearch_name=<your_search_name>​

 

  • While configuring alert in UI ,Trigger Action under Alerts should be selected to Email and provide the correct email
  • could be issues while sending email to SMTP server , you can verify here. 

 

index=_internal source="/opt/splunk/var/log/splunk/python.log" subject="<your_email_subject>" sendemail ERROR​

 

----------

An upvote would be appreciated if it helps!

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...