Alerting

Changing data shown in email alert

robK123
Explorer

I run this search
source="secure" sshd "pam_ldap: error trying to bind as user"|top uid limit=10

which then shows me the top 10 login failures and how many failures they had but I also want it to display the host that failures where on so they are included in the email but I am not sure how to do this?

Tags (1)
0 Karma

jonuwz
Influencer

Might be easier to not use the 'top' command to get this information.

i.e.

source="secure" sshd "pam_ldap: error trying to bind as user"
| stats count values(host) as hosts by uid | sort - count | head 10

Update :

here's a search that going to return data - its the same concept..

index=_internal sourcetype=splunkd earliest=-1h@h latest=@h | bin _time span=15m 
| stats count values(_time) as times by group | sort - count | head 10
0 Karma

jonuwz
Influencer

In that case there's no data returned by the 1st part of the search. See update

0 Karma

robK123
Explorer

Thanks but when I run that it returns no results.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...