Splunk Enterprise Security

Alert not triggering

miguelangelclem
Explorer

Hi all,

I have created an alert with this simple query:

index=foo host="bar" action=fail | stats count by user | search count>40 

It is scheduled every hour and the trigger setting is Number of Results greater than 0

I have tried adding table and fields commands but it still doesn't work

Why could this happen?

0 Karma
1 Solution

harishalipaka
Motivator
0 Karma

harishalipaka
Motivator
0 Karma

memarshall63
Communicator

What is your search time frame?
A user would have to fail 40 times within your search time frame to qualify as an alert.

Is that what you're expecting?

0 Karma

miguelangelclem
Explorer

Yes, I am expecting that.

I have found the problem and was the email configuration as @harishalipaka tell me. The alerts didn't appear because i had not set the action, and the email wasn't sending for a misconfiguration in server.

Thanks!

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...