Alerting

Query for DHCP not returning acknowledgement

waJesu
Path Finder

I need to create an alert for when my DHCP server is not returning acknowledgement. Please help

Labels (1)
0 Karma

inventsekar
Ultra Champion

but I am specifically looking to create an alert for DHCP broadcasts with no acknowledgement// 

Hi @waJesu i am not much sure of this.. but, let me ask, how to find out "DHCP broadcasts with no acknowledgement".. is it updated into some logs or you have some splunk search query?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you logging data from your DHCP server in Splunk?  If so, see https://www.duanewaddle.com/proving-a-negative/.  If not, then start onboarding DHCP info then read the information at the link above.

---
If this reply helps you, Karma would be appreciated.

waJesu
Path Finder

Yeah the DHCP is bring logs into Splunk but I am specifically looking to create an alert for DHCP broadcasts with no acknowledgement. Please help along those lines. Thank you for the link. Though it doesn't have my solution, it is still helpful information to keep.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...