Splunk Search

i am looking for a particular string match in a log file. whenever it sees the String it should alert me with an email.

priyankamundarg
Explorer

Kindly help me with crontab schedule and Trigger Conditions. Am confused in that part. If string matches what should be the trigger condition?

Tags (2)
0 Karma

hliakathali_spl
Splunk Employee
Splunk Employee

You can use particular event code or event description in search string, whenever if any violation happens or particular string match in a log file you will get an alert

Example: if account is locked out we will get an alert immediately by creating the alert by using below query,

index=winsec EventCodeDescription="A user account was locked out" OR E ventCode = 4740|dedup user| stats count by user _time host

Example for Crontab schedule:

The cron parameters, * * * * *, correspond to minute hour day month day-of-week.

*/5 * * * * Every 5 minutes.
*/30 * * * * Every 30 minutes.
0 */12 * * * Every 12 hours, on the hour.
*/20 * * * 1-5 Every 20 minutes, Monday through Friday.
0 9 1-7 * 1 First Monday of each month, at 9am.

Let me know if this is work out.

sundareshr
Legend

Create a search like this

index=yourindexname sourcetype=sourcetypename "matchingstringhere"

Save this as an alert. For schedule you can choose to run it at whatever frequency you would like. For trigger condition, choose "if number of events greater than" 0. For alert mode, select once.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...