https://community.splunk.com/t5/Alerting/How-to-create-an-alert-triggered-by-updated-log-data/m-p/317484#M5683 <P>You search should be able to filter the events which triggered the alert. In the alert settings, check on include results(csv, pdf, inline) and save. It should show you the events which triggered the alert.</P> Fri, 21 Apr 2017 05:22:57 GMT dineshraj9 2017-04-21T05:22:57Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-triggered-by-updated-log-data/m-p/317481#M5680 <P>I am creating an alert. When alert is triggered, i want only the updated data in log file instead of entire log file, without using script.<BR /> I am using Splunk in Windows server 2012 R2.</P> Fri, 24 Feb 2017 09:14:18 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-triggered-by-updated-log-data/m-p/317481#M5680 prakashv546 2017-02-24T09:14:18Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-triggered-by-updated-log-data/m-p/317482#M5681 <P>not understood what you mean by "I want only the updated data". You want a report to be sent from the log file? how do you define the alert? you looking for data which caused the alert to trigger?</P> Sat, 25 Feb 2017 19:39:57 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-triggered-by-updated-log-data/m-p/317482#M5681 koshyk 2017-02-25T19:39:57Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-triggered-by-updated-log-data/m-p/317483#M5682 <P>I am looking for the data which triggered the alert..</P> Mon, 27 Feb 2017 09:56:46 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-triggered-by-updated-log-data/m-p/317483#M5682 prakashv546 2017-02-27T09:56:46Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-triggered-by-updated-log-data/m-p/317484#M5683 <P>You search should be able to filter the events which triggered the alert. In the alert settings, check on include results(csv, pdf, inline) and save. It should show you the events which triggered the alert.</P> Fri, 21 Apr 2017 05:22:57 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-triggered-by-updated-log-data/m-p/317484#M5683 dineshraj9 2017-04-21T05:22:57Z