https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Based-on-Threshold/m-p/609376#M14152 <P>I need to alert on a threshold. I would like to create an alert that looks at a source IP address and will alert me if that address attempts to connect to a threshold of devices over 445. So if Comp1 makes connection to more than 50 devices over 445 within 5 mins, please alert me. Or something like that... Numbers are only for illustration.&nbsp;</P> <P>&nbsp;</P> <P>Thanks.&nbsp;</P> Mon, 15 Aug 2022 13:48:06 GMT brenthelm 2022-08-15T13:48:06Z https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Based-on-Threshold/m-p/609376#M14152 <P>I need to alert on a threshold. I would like to create an alert that looks at a source IP address and will alert me if that address attempts to connect to a threshold of devices over 445. So if Comp1 makes connection to more than 50 devices over 445 within 5 mins, please alert me. Or something like that... Numbers are only for illustration.&nbsp;</P> <P>&nbsp;</P> <P>Thanks.&nbsp;</P> Mon, 15 Aug 2022 13:48:06 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Based-on-Threshold/m-p/609376#M14152 brenthelm 2022-08-15T13:48:06Z https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Based-on-Threshold/m-p/609394#M14155 <P>Please can you provide some anonymised sample events so we can see what it is you are working with? Please include the fields you already have extracted.</P> Sat, 13 Aug 2022 06:57:34 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-Alert-Based-on-Threshold/m-p/609394#M14155 ITWhisperer 2022-08-13T06:57:34Z