About yashaswinig2210

yashaswinig2210 · ‎05-18-2021

I want to trigger an email alert whenever an account is locked on a machine stats values(MachineName) as Machinename by Account, Email, _time Account Machinename Email _time John Machine1 Machine2 John@gmail.com 1:00 PM John Machine2 John@gmail.com 2:00 PM I have set up the alert to run for every 5mins and trigger only once in 24hr suppression value: Account, Machinename Issue: the email is getting triggered twice at 1:00pm and 2:00pm again even the machine name is same. Im not sure if it is considering only machine1 when triggering 1st mail. Request you to please help.

yashaswinig2210 · ‎02-15-2021

I have a scenario where I need to send email to owner of the account when it is locked. I want to run the query for every 5mins checking for last1 hr data, and the email should be sent only once in a day even the account is locked multiple times in a day. And the email configuration is done in the query itself, passing owner field values to email address. As we cannot use throttling in this case(as mail is being sent from search query), could anyone please suggest a solution?

yashaswinig2210 · ‎02-14-2021

In this case my email should be sent to the owner of the account which im getting from the query itself, is there any way to pass field value from the query to send an email from alerts?

yashaswinig2210 · ‎02-14-2021

Hi, I'm trying to pull the event logs when an account is being locked in Active Directory, but I could see multiple entries for single account, one entry for each 1 or 2 hrs . Could please help me in understanding why duplicate entries are being generated in splunk?

yashaswinig2210 · ‎02-11-2021

Could you please tell how can we give throttling and suppression values within the query as the mail is being triggered from the query itself

yashaswinig2210 · ‎02-11-2021

Hi, I have a query which sends email based on the result and is scheduled for every 5mins.Below is the search |mysearch | table Owner, AccountName,Machine | outputcsv Account.csv | map search=" |inputcsv Account.csv | table Owner, AccountName,Machine|where Owner=\"$Owner$\" |sendemail sendresults=true inline=true from=\"abc@gmail.com\" to=\"$Owner$\" subject=\"$AccountName$ \"" this is sending email to the owner every 5mins , my want is the email should be triggered to owner only when it is not triggered in last 24hrs even it is scheduled for 5mins based on the AccountName. can we use throttling in this case or Could you please provide me a solution.

yashaswinig2210 · ‎12-29-2020

Hi All, @renjith_nair I'm working on a requirement to create a Splunk Alert which triggers/Creates the Incident in Service Now portal. I want the alert to create multiple incidents for each result. My Findings : The alert creates Single Incident with multiple events for each result in ServiceNow. Requirement : Alert should be able to create Incident for each result in ServiceNow. How can this be achieved?

yashaswinig2210 · ‎12-23-2020

@scelikok it didnt work for my sourcetype , can use the same stats with lookups?

yashaswinig2210 · ‎12-23-2020

Hi @renjith_nair Im trying to join two tables which have a common field but its not giving complete data as the tables have more than a lakh rows .? Is there any other option rather than join to combine the two tables

yashaswinig2210 · ‎12-21-2020

Hey thanks now I realised my mistake i have used mvexpand on my lookup so it didnt work and now I tried mvexpand on actual index and sourcetype its working fine

yashaswinig2210 · ‎12-21-2020

@renjith_nair No mvexpand didnt work

yashaswinig2210 · ‎12-21-2020

Hi, I have a query which gives GroupName and its members in the below format GroupName member Domain Admins CN=firstname1\, lastname1 P0,OU=P0-Accounts,OU=test OU CN=firstname2\, lastname2 P1,OU=P1-Accounts,OU=test OU CN=firstname3\, lastname3 P3,OU=P3-Accounts,OU=test OU And im trying to extract it in multiple events like below seperately for each and every member GroupName member Domain Admins CN=firstname1\, lastname1 P0,OU=P0-Accounts,OU=test OU Domain Admins CN=firstname2\, lastname2 P1,OU=P1-Accounts,OU=test OU Domain Admins CN=firstname3\, lastname3 P3,OU=P3-Accounts,OU=test OU

Posts	12
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎12-20-2020

Online Status	Offline
Date Last Visited	‎05-18-2021 08:55 AM

Alert throttling

sending email

Monitoring Event Logs

sending email with search

Multiple incident creation on servicenow through ...

Missing data when joining two larger sourcetypes w...

extract a multiline field value into multiple even...