Alerting

Why is one of my email alert fields blank?

SecureIA
Path Finder

I am alerting on a failed login search provided below:-

host=CATSG14 "Failed login" GATEWAY="" USER_IDv3=""| stats count by USER_IDv3

I would like my email alert to say:

The alert condition for '$name$' was triggered.

User $result.USER_IDv3$ is having trouble accessing the $GATEWAY$ gateway.

The email picks out the USER_IDv3 field, but leaves the GATEWAY field blank. Is there anyway to grab the GATEWAY field?

0 Karma
1 Solution

javiergn
Super Champion

That's because your stats does not return the GATEWAY name and therefore is not part of the results.

Try this instead:

host=CATSG14 "Failed login" GATEWAY="*" USER_IDv3="*"| stats count by USER_IDv3, GATEWAY

Keep in mind you'll need to use $result. GATEWAY$ and not $GATEWAY$ in your alert by the way

View solution in original post

javiergn
Super Champion

That's because your stats does not return the GATEWAY name and therefore is not part of the results.

Try this instead:

host=CATSG14 "Failed login" GATEWAY="*" USER_IDv3="*"| stats count by USER_IDv3, GATEWAY

Keep in mind you'll need to use $result. GATEWAY$ and not $GATEWAY$ in your alert by the way

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...