Alerting

Is any way to include logs/events in Alert email?

summerura
Explorer

Hi Splunkers!

i set the alert with "upload". which means someone upload something, i get email.
The email is only included last event. But i want to get email with a few previous events.

for example, if logs are like this

[date:02.08.2019] [user:haha] [c:login]
[date:02.08.2019] [user:haha] [c:download]
[date:02.08.2019] [user:haha] [c:edit]
[date:02.08.2019] [user:haha] [c:upload]

i got email only with last line which is "[date:02.08.2019] [user:haha] [c:upload]".
But i want to get alert email not only event but also previous events.
which is "[date:02.08.2019] [user:haha] [c:edit], [date:02.08.2019] [user:haha] [c:upload] " or even last 3 events.

is it possible?

Thanks for reading

0 Karma

woodcock
Esteemed Legend

Everybody is very confused at this point. You should probably back ALL the way up and start over. What do your events look like? What is your search SPL? What are your alert settings?

0 Karma

summerura
Explorer

Hi, @woodcock
Thanks for help!

i think we understood wrong eachother. i want to explain again...

We have "audit_log" from our software in splunk and the data are updated every second.
There are sometimes log-in error if somebody give wrong password or when the server has problem.
and we set the email-alert when somebody have log-in error.
BUT we want to also include the last audit_log line in email-alert.
My question was whether it is possible or not...
Do you have any idea?

Thanks

0 Karma

woodcock
Esteemed Legend

Put your threshold into the SPL like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="blahblah" AND host="blahblah" AND c=upload
| eventstats count(or other aggregation function here) AS trigger BY host and/or maybe other fields here
| where trigger > YourThresholdHere

Then set your alert for Number of events and Is greater than 0 and click the boxes to include all events.

0 Karma

woodcock
Esteemed Legend

You can setup the alert to send all events and then end your alerting search SPL with ... | head 5

0 Karma

summerura
Explorer

I tried

host="blahblah" AND c=upload AND sourcetype="blahblah"

| head 5

but it's nor working

0 Karma

summerura
Explorer

makes sense. Thanks, but how can I call all events?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...