Splunk Enterprise Security

Alert not triggering

miguelangelclem
Explorer

Hi all,

I have created an alert with this simple query:

index=foo host="bar" action=fail | stats count by user | search count>40 

It is scheduled every hour and the trigger setting is Number of Results greater than 0

I have tried adding table and fields commands but it still doesn't work

Why could this happen?

0 Karma
1 Solution

harishalipaka
Motivator
0 Karma

harishalipaka
Motivator
0 Karma

memarshall63
Communicator

What is your search time frame?
A user would have to fail 40 times within your search time frame to qualify as an alert.

Is that what you're expecting?

0 Karma

miguelangelclem
Explorer

Yes, I am expecting that.

I have found the problem and was the email configuration as @harishalipaka tell me. The alerts didn't appear because i had not set the action, and the email wasn't sending for a misconfiguration in server.

Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...