Email Alerts

[luckymaddy]

Hi,

I want to set an “Email alert when User failed login 5 times in last 10 minutes.
Please help me.

Thanks in Advance

[mdessus_splunk]

Edit the "Excessive failed login" default correlation search, change the count in the search, and edit the time parameters (Start time, End time, Cron Schedule) to run it each 10 minutes as said before.

[stephane_cyrill]

HI luckymaddy,

1-write your request that gives you the failed login as you want. it depends on your data.it may be something like:

source=security_log_file failed login earliest=10| timechart count by user|where count> 5

2-execute it in search and click SAVE AS ALERT.

3-on the first window put the title and chose what you want.....

4- on the 2nd window click SEND E-MAIL and fill the required informations. you can even customize the message to send by including a token value.

5-click save.

see all the details here:

docs.splunk.com/Documentation/Splunk/6.2.2/Alert/Alertexamples

[juvetm]

can you try something like this

* 10 /* * * *