Alerting

Is any way to include logs/events in Alert email?

Explorer

Hi Splunkers!

i set the alert with "upload". which means someone upload something, i get email.
The email is only included last event. But i want to get email with a few previous events.

for example, if logs are like this

[date:02.08.2019] [user:haha] [c:login]
[date:02.08.2019] [user:haha] [c:download]
[date:02.08.2019] [user:haha] [c:edit]
[date:02.08.2019] [user:haha] [c:upload]

i got email only with last line which is "[date:02.08.2019] [user:haha] [c:upload]".
But i want to get alert email not only event but also previous events.
which is "[date:02.08.2019] [user:haha] [c:edit], [date:02.08.2019] [user:haha] [c:upload] " or even last 3 events.

is it possible?

Thanks for reading

0 Karma

Esteemed Legend

Everybody is very confused at this point. You should probably back ALL the way up and start over. What do your events look like? What is your search SPL? What are your alert settings?

0 Karma

Explorer

Hi, @woodcock
Thanks for help!

i think we understood wrong eachother. i want to explain again...

We have "audit_log" from our software in splunk and the data are updated every second.
There are sometimes log-in error if somebody give wrong password or when the server has problem.
and we set the email-alert when somebody have log-in error.
BUT we want to also include the last audit_log line in email-alert.
My question was whether it is possible or not...
Do you have any idea?

Thanks

0 Karma

Esteemed Legend

Put your threshold into the SPL like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="blahblah" AND host="blahblah" AND c=upload
| eventstats count(or other aggregation function here) AS trigger BY host and/or maybe other fields here
| where trigger > YourThresholdHere

Then set your alert for Number of events and Is greater than 0 and click the boxes to include all events.

0 Karma

Esteemed Legend

You can setup the alert to send all events and then end your alerting search SPL with ... | head 5

0 Karma

Explorer

I tried

host="blahblah" AND c=upload AND sourcetype="blahblah"

| head 5

but it's nor working

0 Karma

Explorer

makes sense. Thanks, but how can I call all events?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!