All Apps and Add-ons

How to trigger alerts on the count of the value of a custom field?

olawalePS
Path Finder

I am trying to create an alert for multiple failed logins but my query doesn't seem to work.

The alert is detailed in the image attached, and the query is:

index="authenticate" eventType="user.session.start" outcome.result="FAILURE"
| stats count by actor.alternateId

Please help correct the query.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @olawalePS,

insert the condition in the search:

index="authenticate" eventType="user.session.start" outcome.result="FAILURE"
| stats count by actor.alternateId
| where count>3

and trigger the alert when results>0

then I don't like to have dots in a field so I prefer:

index="authenticate" eventType="user.session.start" outcome.result="FAILURE"
| rename actor.alternateId AS alternateId
| stats count by alternateId
| where count>3

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @olawalePS,

insert the condition in the search:

index="authenticate" eventType="user.session.start" outcome.result="FAILURE"
| stats count by actor.alternateId
| where count>3

and trigger the alert when results>0

then I don't like to have dots in a field so I prefer:

index="authenticate" eventType="user.session.start" outcome.result="FAILURE"
| rename actor.alternateId AS alternateId
| stats count by alternateId
| where count>3

Ciao.

Giuseppe

olawalePS
Path Finder

I modified the search but it still did not trigger an alert. is the cron job schedule configured correctly?

I attached the screenshot of the config

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @olawalePS,

your search is schedule to run one time a week (Monday at 6:00) on the last 10 minutes, is it correct?

Ciao.

Giuseppe

 

0 Karma

olawalePS
Path Finder

@gcusello No, I want it to run every 10 minutes.

0 Karma

olawalePS
Path Finder

@gcusello I have corrected the cron expression. Thanks for helping to point it out

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...