https://community.splunk.com/t5/Alerting/How-to-get-a-count-of-events-that-generates-an-alert-after-a/m-p/226592#M4154 <P>Try something like this</P> <PRE><CODE>index=yourindex sourcetype=yoursourcetype param_device_id="USB*" | stats count by host_name | where count&gt;yourXvalue </CODE></PRE> <P>Set the alert condition as Where number of event &gt; 0 from this search</P> Wed, 16 Sep 2015 21:47:23 GMT somesoni2 2015-09-16T21:47:23Z https://community.splunk.com/t5/Alerting/How-to-get-a-count-of-events-that-generates-an-alert-after-a/m-p/226589#M4151 <P>I am trying to have a count of events that generates an alert after a host has more than x USB related events during a given amount of time. </P> <P>This is the type of event:</P> <PRE><CODE>1 » 9/16/15 3:56:29.653 AM usn="46558922" time_stamp="2015-09-16 03:56:29.653 UTC" host_name="HOST" vapi_name="File Write" begin_time="2015-09-15 16:15:52.502 UTC" end_time="2015-09-15 17:00:44.533 UTC" caller_process_id="2128" caller_process_name="C:/Program.exe" parameter="F:/" user_name="SYSTEM" ip_addr="0.0.0.0" file_size="0" param_device_id="USBSTOR\Disk&amp;Ven_HUAWEI&amp;Prod_TF_CARD_Storage&amp;Rev_2.31\7&amp;12ad7558&amp;0" </CODE></PRE> Wed, 16 Sep 2015 19:03:24 GMT https://community.splunk.com/t5/Alerting/How-to-get-a-count-of-events-that-generates-an-alert-after-a/m-p/226589#M4151 seaed_ac 2015-09-16T19:03:24Z https://community.splunk.com/t5/Alerting/How-to-get-a-count-of-events-that-generates-an-alert-after-a/m-p/226590#M4152 <P>Save this search and trigger for <CODE>Number of events greater than 0</CODE>:</P> <PRE><CODE>... | stats count by host | where count &lt; X </CODE></PRE> Wed, 16 Sep 2015 21:35:45 GMT https://community.splunk.com/t5/Alerting/How-to-get-a-count-of-events-that-generates-an-alert-after-a/m-p/226590#M4152 woodcock 2015-09-16T21:35:45Z https://community.splunk.com/t5/Alerting/How-to-get-a-count-of-events-that-generates-an-alert-after-a/m-p/226591#M4153 <P>Hi there.<BR /> Thank you for your reply. How can I differentiate between the different hosts. Basically what I am trying to achieve is to be alerted when a user goes over a pre-defined number of files while using a usb external hdd. So far I get all the hosts together but I need to have it separated either by host_name or by user_name </P> Tue, 29 Sep 2020 07:16:56 GMT https://community.splunk.com/t5/Alerting/How-to-get-a-count-of-events-that-generates-an-alert-after-a/m-p/226591#M4153 seaed_ac 2020-09-29T07:16:56Z https://community.splunk.com/t5/Alerting/How-to-get-a-count-of-events-that-generates-an-alert-after-a/m-p/226592#M4154 <P>Try something like this</P> <PRE><CODE>index=yourindex sourcetype=yoursourcetype param_device_id="USB*" | stats count by host_name | where count&gt;yourXvalue </CODE></PRE> <P>Set the alert condition as Where number of event &gt; 0 from this search</P> Wed, 16 Sep 2015 21:47:23 GMT https://community.splunk.com/t5/Alerting/How-to-get-a-count-of-events-that-generates-an-alert-after-a/m-p/226592#M4154 somesoni2 2015-09-16T21:47:23Z https://community.splunk.com/t5/Alerting/How-to-get-a-count-of-events-that-generates-an-alert-after-a/m-p/226593#M4155 <P>The search already does count <CODE>by host</CODE>; if you need <CODE>by host_name</CODE> then do this:</P> <PRE><CODE> ... | stats count by host_name | where count &lt; X </CODE></PRE> Wed, 16 Sep 2015 23:53:43 GMT https://community.splunk.com/t5/Alerting/How-to-get-a-count-of-events-that-generates-an-alert-after-a/m-p/226593#M4155 woodcock 2015-09-16T23:53:43Z