Alerting

Query for DHCP not returning acknowledgement

waJesu
Path Finder

I need to create an alert for when my DHCP server is not returning acknowledgement. Please help

Labels (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

but I am specifically looking to create an alert for DHCP broadcasts with no acknowledgement// 

Hi @waJesu i am not much sure of this.. but, let me ask, how to find out "DHCP broadcasts with no acknowledgement".. is it updated into some logs or you have some splunk search query?

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are you logging data from your DHCP server in Splunk?  If so, see https://www.duanewaddle.com/proving-a-negative/.  If not, then start onboarding DHCP info then read the information at the link above.

---
If this reply helps you, Karma would be appreciated.

waJesu
Path Finder

Yeah the DHCP is bring logs into Splunk but I am specifically looking to create an alert for DHCP broadcasts with no acknowledgement. Please help along those lines. Thank you for the link. Though it doesn't have my solution, it is still helpful information to keep.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...