Alert when Splunk user did not login for last 15 minutes

[raindrop18]

I have put this string on my search and set to run every 15 min, the objective is to send me no log activity on Splunk which indicate no one try to login to the site. but I didn't get the alert the when the event happened. where is my mistake? thanks !!

|metadata index="users" sourcetype="USERS Login"|eval Latest=strftime(lastTime, "%d/%m/%Y %I:%M:%S %p")|eval max_delta=900|eval delta=now() - lastTime|where delta > max_delta

[martin_mueller · Accepted solution]

You're looking for no login in the past 15 minutes, right? Consider this:

index="users" sourcetype="USERS Login" | head 1 | eval age = now() - _time

Run over All Time, the head 1 will pick out the most recent login event. Set the alert condition to alert if age > 900. Run as often as you like - note, running every 15 minutes may not catch a 29:59 minute gap if spaced as far away as possible.

[raindrop18]

awesome, thanks much!!!

[martin_mueller]

Set trigger condition to "custom" and use this as the condition:

where age > 900

That'll run the where command after the search, and only trigger the alert if the event is indeed older than 900 seconds.

[raindrop18]

thanks Martin, it's working, I just set the alert when the result less than 1, how I can use " if age > 900" I have never used this option before.

[somesoni2]

Since you're running the search every 15 min, why not just see if there are events in last 15 minutes. If there are any event, then someone logged in, if not there are no activities.

Search String:

index="users" sourcetype="USERS Login" 

Start time=-15m@m
Finish time=@m

Alert condition: When no of event is greater than 0.

[raindrop18]

my own site login information is indexed in SPlunk.

[somesoni2]

I guess the search query is wrong here. The metadata command doesn't accept sourcetype. Does index 'users' and sourcetype 'USERS Login' exists and contains user login information? You want login activities for Splunk Web or for your own site whose login information is indexed in SPlunk?