Alerting

Alert when user is log off

ajromero
Path Finder

I need to get an alert when a user is log off from a server, here is my query

index="wineventlog" user="*.COM" OR user="*"
| head 1 | eval age = now() - _time
|table _time user name

Then I'm setting a custom alert to

ajromero_0-1623797502045.png

but I don't get any alert

Thank you,

 

 

 

Labels (2)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @ajromero I don't find age field in your table command, there could be other reasons.

  • age > 900 condition might not met, you can try same query in UI with | where age > 900 at the end exactly select time similar to schedule window. Lower age threshold and retry.
  • Your role/user assigned to these alerts to run alerts might not be having schedule search capability. You can run following query to find out what exactly happening with your search

 

index=_internal sourcetype="scheduler" savedsearch_name=<your_search_name>​

 

  • While configuring alert in UI ,Trigger Action under Alerts should be selected to Email and provide the correct email
  • could be issues while sending email to SMTP server , you can verify here. 

 

index=_internal source="/opt/splunk/var/log/splunk/python.log" subject="<your_email_subject>" sendemail ERROR​

 

----------

An upvote would be appreciated if it helps!

View solution in original post

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ajromero 

Can you try this works? added age field to table command.

index="wineventlog" user="*.COM" OR user="*"
| head 1 | eval age = now() - _time
|table _time user name age

----

An upvote would be appreciated if it helps!

0 Karma

ajromero
Path Finder

Hi,

I already have the age field in the table and it doesn't do it

index="wineventlog" user="*.COM" OR user="*"
| head 1 | eval age = now() - _time
|table _time user name

 

thanks

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @ajromero I don't find age field in your table command, there could be other reasons.

  • age > 900 condition might not met, you can try same query in UI with | where age > 900 at the end exactly select time similar to schedule window. Lower age threshold and retry.
  • Your role/user assigned to these alerts to run alerts might not be having schedule search capability. You can run following query to find out what exactly happening with your search

 

index=_internal sourcetype="scheduler" savedsearch_name=<your_search_name>​

 

  • While configuring alert in UI ,Trigger Action under Alerts should be selected to Email and provide the correct email
  • could be issues while sending email to SMTP server , you can verify here. 

 

index=_internal source="/opt/splunk/var/log/splunk/python.log" subject="<your_email_subject>" sendemail ERROR​

 

----------

An upvote would be appreciated if it helps!

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...