Alerting

unix_TA lastlog.sh match for alert

rafaelruales
Explorer

Hi,

I am trying to figure out how to create an alert when a specific user appears in the output of the lastlog.sh script.

The output is a nicely formatted table as follows:

UsernameFromLatest
user11.1.1.1fri Mar 4 2:20

 

I am new to splunk, I cannot figure out how I would create a query that would model something like an object where I can loop through everything under the username column and then do a lookup to see if user1 exists.

Any help would be appreciated, the ultimate goal is for the query to show if "user1" appears in the output of:

host=our_server sourcetype=lastlog

any links to documentation for this would be helpful too 

Labels (2)
0 Karma
1 Solution

rafaelruales
Explorer

I was able to get this going after some research using a query similar to this and setting the alert to trigger if the results of the search is greater than 0.

host=myHostHere sourcetype=lastlog
| multikv fields USERNAME
| where USERNAME = "user1" OR USERNAME = "user2"
| table host USERNAME

View solution in original post

0 Karma

rafaelruales
Explorer

I was able to get this going after some research using a query similar to this and setting the alert to trigger if the results of the search is greater than 0.

host=myHostHere sourcetype=lastlog
| multikv fields USERNAME
| where USERNAME = "user1" OR USERNAME = "user2"
| table host USERNAME

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...