I need to get an alert when a user is log off from a server, here is my query
index="wineventlog" user="*.COM" OR user="*"| head 1 | eval age = now() - _time|table _time user name
Then I'm setting a custom alert to
but I don't get any alert
Hi @ajromero I don't find age field in your table command, there could be other reasons.
index=_internal sourcetype="scheduler" savedsearch_name=<your_search_name>
index=_internal source="/opt/splunk/var/log/splunk/python.log" subject="<your_email_subject>" sendemail ERROR
An upvote would be appreciated if it helps!
View solution in original post
Can you try this works? added age field to table command.
index="wineventlog" user="*.COM" OR user="*"
| head 1 | eval age = now() - _time
|table _time user name age
I already have the age field in the table and it doesn't do it