Alerting

How to send email alert if certain text is found in a log file?

scottystang
New Member

Hello,

I'm new to splunk and was curious if there's a way to configure an email alert that happens if certain text appears in a log file.

For example, in my sample.log file I want to check for the text "this is something bad" and then email me when it's found.

Can splunk do this? If so, can you point me to a tutorial as to how?

Thank you!

Tags (2)
0 Karma

scottystang
New Member

Awesome, thanks for the replies. I'll give it a shot, sounds straight forward!

0 Karma

jeffland
SplunkTrust
SplunkTrust

You don't neccessarily need a tutorial for that, that's very simple!

One of the ideas of alerts is to send an email whenever a search returns (more than a certain number of of) results. So what you do is create a search as simple as

index=foo "this is something bad"

set the timeframe for the search and the schedule to something that suits your need (i.e. search over a timeframe of the last hour and schedule it to run every hour) and send you an alert as soon as it returns a result. If you want, have a look here for more detail.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, Splunk can do that. First, create a search that looks for the text. Then schedule that search to run regularly by checking the "Schedule and Alert" box. Select "if number of events" from the Condition drop-down and put 0 (zero) as the triggering quantity. Check the "Send email" box under "Alert Actions" and fill in the To and CC fields as desired. Save those settings and you should get an alert the next time the search finds that text in your log file.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...