Alerting

unix_TA lastlog.sh match for alert

rafaelruales
Explorer

Hi,

I am trying to figure out how to create an alert when a specific user appears in the output of the lastlog.sh script.

The output is a nicely formatted table as follows:

UsernameFromLatest
user11.1.1.1fri Mar 4 2:20

 

I am new to splunk, I cannot figure out how I would create a query that would model something like an object where I can loop through everything under the username column and then do a lookup to see if user1 exists.

Any help would be appreciated, the ultimate goal is for the query to show if "user1" appears in the output of:

host=our_server sourcetype=lastlog

any links to documentation for this would be helpful too 

Labels (2)
0 Karma
1 Solution

rafaelruales
Explorer

I was able to get this going after some research using a query similar to this and setting the alert to trigger if the results of the search is greater than 0.

host=myHostHere sourcetype=lastlog
| multikv fields USERNAME
| where USERNAME = "user1" OR USERNAME = "user2"
| table host USERNAME

View solution in original post

0 Karma

rafaelruales
Explorer

I was able to get this going after some research using a query similar to this and setting the alert to trigger if the results of the search is greater than 0.

host=myHostHere sourcetype=lastlog
| multikv fields USERNAME
| where USERNAME = "user1" OR USERNAME = "user2"
| table host USERNAME

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...