Splunk Search

Splunk triggers an alert but shouldn't

Path Finder


I have implemented an correlation search, where I want to find "Brute Force Behavior" and afterwards an "User was added to Domain Admins" Event with the following search:

(EventCode=4625 "bad password") OR (EventCode=4624 successfully Logon_Type=10) OR (EventCode=4728 "A member was added to a security-enabled*") | eval Account_Name=mvfilter(Account_Name!="-") | eval Account_Name = lower(Account_Name) | transaction Account_Name maxspan=2m endswith=(EventCode=4728 "A member was added to a security-enabled*") | where eventcount>=7

I have saved this search as an alert

When I test and do false logins followed by a real login this alert triggers (this alert shouldn't trigger at this moment because no member was added to a security-enabeld group") and I get an email notification. When I look up the alarm afterwards splunk does not find any result, as it should.

So why do I get an alarm when the search doesn't find anything? and does anyone know how to fix this issue?

best regards

0 Karma

Path Finder

This might be way to simple, but is it possible that you have the alert condition set to "always" rather than something like "if number of events is greater that X"

Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...