Skip to main content
Alert on failed sign-ins to Splunk, then set the alert off on purpose and watch it fire. Launch Lab 9 in the IP Lab Portal

​
What you will do

  1. Search for failed sign-ins to Splunk
  2. Save the search as an alert
  3. Set off the alert on purpose
  4. Watch it fire in Triggered Alerts

​
Before you start

Time

45 minutes

Role

admin

Module

Module 13: Scheduled Reports and Alerts

  • Click Launch Lab 9 in the IP Lab Portal to open the lab page, then click Launch to start your machine.
  • Starting a lab counts as an attempt. Tick off steps in the lab guide to track your progress.
  • The course data is access_30DAY.log, linux_s_30DAY.log, db_audit_30DAY.csv and products.csv.
  • Review the slides in Module 13 Material before you start.