topic Per - result Alert in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Per-result-Alert/m-p/702916#M12153 <P>I am a grad student and I recently gave a quiz on splunk. There was a true/false question.</P><P>Q: Splunk Alerts can be created to monitor machine data in real-time, alerting of an event as soon as it logged by the host.&nbsp;</P><P>I marked it as false because it should be "as soon as the event gets indexed by Splunk" instead of "as soon as the event gets logged by the host".&nbsp;</P><P>I have raised a question because I was not awarded marks for this question. But the counter was "Per-result triggering helps to achieve this". But isn't it basic that Splunk can only read the indexed data? Can anyone please verify if I'm correct?&nbsp;</P><P>Thanks in advance.</P> Mon, 28 Oct 2024 00:29:30 GMT rvnk 2024-10-28T00:29:30Z Per - result Alert https://community.splunk.com/t5/Splunk-Enterprise-Security/Per-result-Alert/m-p/702916#M12153 <P>I am a grad student and I recently gave a quiz on splunk. There was a true/false question.</P><P>Q: Splunk Alerts can be created to monitor machine data in real-time, alerting of an event as soon as it logged by the host.&nbsp;</P><P>I marked it as false because it should be "as soon as the event gets indexed by Splunk" instead of "as soon as the event gets logged by the host".&nbsp;</P><P>I have raised a question because I was not awarded marks for this question. But the counter was "Per-result triggering helps to achieve this". But isn't it basic that Splunk can only read the indexed data? Can anyone please verify if I'm correct?&nbsp;</P><P>Thanks in advance.</P> Mon, 28 Oct 2024 00:29:30 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Per-result-Alert/m-p/702916#M12153 rvnk 2024-10-28T00:29:30Z Re: Per - result Alert https://community.splunk.com/t5/Splunk-Enterprise-Security/Per-result-Alert/m-p/702917#M12154 <P>Real-time searches see events before they are indexed.</P> Mon, 28 Oct 2024 00:39:06 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Per-result-Alert/m-p/702917#M12154 richgalloway 2024-10-28T00:39:06Z