https://community.splunk.com/t5/Alerting/How-to-create-an-alert-when-process-appears-in-multiple-IPs/m-p/442506#M7747 <P>Say I have a table of processes and IP addresses. I want to make an alert when a certain process was monitored in multiple computers during the last 24 hours. How can I do it?</P> <P>Very specific question I know, I just didn't know how to phrase it otherwise.</P> Tue, 04 Sep 2018 14:16:09 GMT agentsofshield 2018-09-04T14:16:09Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-when-process-appears-in-multiple-IPs/m-p/442506#M7747 <P>Say I have a table of processes and IP addresses. I want to make an alert when a certain process was monitored in multiple computers during the last 24 hours. How can I do it?</P> <P>Very specific question I know, I just didn't know how to phrase it otherwise.</P> Tue, 04 Sep 2018 14:16:09 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-when-process-appears-in-multiple-IPs/m-p/442506#M7747 agentsofshield 2018-09-04T14:16:09Z https://community.splunk.com/t5/Alerting/How-to-create-an-alert-when-process-appears-in-multiple-IPs/m-p/442507#M7748 <P>@agentsofshield,</P> <P>Try</P> <PRE><CODE>your search|fields process,ipaddress|stats dc(ipaddress) as count,values(ipaddress) as ipaddress by process|where count &gt;1 </CODE></PRE> Tue, 04 Sep 2018 14:44:58 GMT https://community.splunk.com/t5/Alerting/How-to-create-an-alert-when-process-appears-in-multiple-IPs/m-p/442507#M7748 renjith_nair 2018-09-04T14:44:58Z