Splunk Search

Send email if one event happens but the other doesn't after 24 hours

mrmc
Explorer

I'm attempting to craft an alert that notifies myself and the user that requested access that they haven't revoked their access to a support site. My tool writes to splunk that they requested access, and then that they revoked access. But, if they forget to revoke access, I'd like to notify them that they forgot after 24 hours.

User johndoe (ID: 123) requested access to the site (ID: 123) located at http://subdomain.example.com.

User johndoe (ID: 123) revoked their access to the site (ID: 123) located at http://subdomain.example.com.

I'm a splunk noob, so I apologize if this is a pretty straightforward answer and I really appreciate the help.

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | rex "User\s+(?<user>\S+).*?(?<action>requested|revoked)" | stats latest(_time) AS time latest(action) AS action BY user | eval age=now()-time | where age>(24*60*60) AND action=requested

View solution in original post

woodcock
Esteemed Legend

Like this:

... | rex "User\s+(?<user>\S+).*?(?<action>requested|revoked)" | stats latest(_time) AS time latest(action) AS action BY user | eval age=now()-time | where age>(24*60*60) AND action=requested

mrmc
Explorer

Thanks for this! They can request access to different sites, and we only want to notify if they haven't revoked access to those specific sites. Is there a way to extend the regex to match the site ID too?

0 Karma

woodcock
Esteemed Legend

Like this:

... | rex "User\s+(?<user>\S+).*?(?<action>requested|revoked).*?site\s+\(ID:\s+(?<siteID>[^\)]+)" | stats latest(_time) AS time latest(action) AS action BY user siteID | eval age=now()-time | where age>(24*60*60) AND action=requested

mrmc
Explorer

@woodcock, I'm experiencing the following error:

Error in 'rex' command: Encountered the following error while compiling the regex 'User\s+(?\S+).*?(?)requested|revoked).*?site\s+\(ID:\s+(?[^\)]+)': Regex: unmatched parentheses

I know the error is somewhere near .*?(?)requested|revoked). I'm just not sure where to put the extra parentheses. Could you help?

0 Karma

woodcock
Esteemed Legend

Sorry, I had a typo but I went back and fixed (re-edited) all the answers and it should all work now.

0 Karma

mrmc
Explorer

Thank you so much, this will work excellent!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...