Alerting

unix_TA lastlog.sh match for alert

rafaelruales
Explorer

Hi,

I am trying to figure out how to create an alert when a specific user appears in the output of the lastlog.sh script.

The output is a nicely formatted table as follows:

UsernameFromLatest
user11.1.1.1fri Mar 4 2:20

 

I am new to splunk, I cannot figure out how I would create a query that would model something like an object where I can loop through everything under the username column and then do a lookup to see if user1 exists.

Any help would be appreciated, the ultimate goal is for the query to show if "user1" appears in the output of:

host=our_server sourcetype=lastlog

any links to documentation for this would be helpful too 

Labels (2)
0 Karma
1 Solution

rafaelruales
Explorer

I was able to get this going after some research using a query similar to this and setting the alert to trigger if the results of the search is greater than 0.

host=myHostHere sourcetype=lastlog
| multikv fields USERNAME
| where USERNAME = "user1" OR USERNAME = "user2"
| table host USERNAME

View solution in original post

0 Karma

rafaelruales
Explorer

I was able to get this going after some research using a query similar to this and setting the alert to trigger if the results of the search is greater than 0.

host=myHostHere sourcetype=lastlog
| multikv fields USERNAME
| where USERNAME = "user1" OR USERNAME = "user2"
| table host USERNAME

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>