How to create an email notification for Event Iden...

Splunk Cloud Platform

Hello all,

In our company I need to create a daily email notification for

Remote logn
Disabled account
Event Log Stopped or Cleared Search
Account Lockout

Please suggest which windows event correspond to above alerts. From my reading I think 4624, 4725, 1102, 4740 are the windows event IDs that I need to monitor but not sure.

Thank you

Get Updates on the Splunk Community!

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...