https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575060#M101639 <P>Hi,</P><P>I am trying to create an alert that triggers when more than 5 files are deleted in less than 3 minutes from the app we monitor.&nbsp;</P><P>For some reason, the alert only works for single file deletion but does not work when I set it for. a number of events. any idea why? would love to get some help</P> Tue, 16 Nov 2021 14:39:22 GMT mishmeret 2021-11-16T14:39:22Z https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575060#M101639 <P>Hi,</P><P>I am trying to create an alert that triggers when more than 5 files are deleted in less than 3 minutes from the app we monitor.&nbsp;</P><P>For some reason, the alert only works for single file deletion but does not work when I set it for. a number of events. any idea why? would love to get some help</P> Tue, 16 Nov 2021 14:39:22 GMT https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575060#M101639 mishmeret 2021-11-16T14:39:22Z https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575061#M101640 Can you post your SPL and some sample events? Tue, 16 Nov 2021 14:40:16 GMT https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575061#M101640 isoutamo 2021-11-16T14:40:16Z https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575063#M101641 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screen Shot 2021-11-16 at 16.42.30.png" style="width: 778px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16874i864B8A62B96D9C5A/image-size/large?v=v2&amp;px=999" role="button" title="Screen Shot 2021-11-16 at 16.42.30.png" alt="Screen Shot 2021-11-16 at 16.42.30.png" /></span></P> Tue, 16 Nov 2021 14:42:52 GMT https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575063#M101641 mishmeret 2021-11-16T14:42:52Z https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575064#M101642 <P>attached a screen shot, in the actions it send an email to out ticking system</P> Tue, 16 Nov 2021 14:43:36 GMT https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575064#M101642 mishmeret 2021-11-16T14:43:36Z https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575117#M101654 How about actual SPL query and event samples? Tue, 16 Nov 2021 19:11:45 GMT https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575117#M101654 isoutamo 2021-11-16T19:11:45Z https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575123#M101656 <P>thats the query I used: host="ip-of the host" "event_type..tag"=file_delete</P><P>works for single file deletion</P> Tue, 16 Nov 2021 19:24:43 GMT https://community.splunk.com/t5/Getting-Data-In/Create-an-alert-when-multiple-files-are-deleted/m-p/575123#M101656 mishmeret 2021-11-16T19:24:43Z