topic Re: How to create Splunk alerts? in Training + Certification Discussions

How to create Splunk alerts?

ish — Thu, 01 Apr 2021 18:16:04 GMT

i need to set email alerts for malicous activites in Splunk

I also need to set all security measures for enterprise server

Please help

Re: How to create Splunk alerts?

richgalloway — Thu, 01 Apr 2021 18:23:24 GMT

Those are two vague statements that should be separate postings.

To create an alert, start with a search. Find the condition that will trigger the alert, whatever that may be. When you're happy with the search results, click the Save As link and save it as an alert. See https://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts for details.

The second question is far too broad and vague to address.

Re: How to create Splunk alerts?

ish — Thu, 01 Apr 2021 19:17:38 GMT

Thanks so much for reply

I just start learning Splunk

I want to know if i don't have any existing data for search, Do I have to create new search?

How I add data about malicous activities as new search

how I will set alerts goes to my email

Thank===

Re: How to create Splunk alerts?

richgalloway — Thu, 01 Apr 2021 20:04:35 GMT

If you don't have any data then you have nothing to search. Add data then search it.

If we could add data only about malicious activities then our jobs would be much easier. Instead, we have to add the data we have and then search it for indications of suspected malicious activity. What data to add depends on what you have and which activities you care about.

Once you have a working search and save it as an alert then Splunk will ask what you want to do with the alert. One of the options is to send email. See the manual cited above.

Re: How to create Splunk alerts?

ish — Fri, 02 Apr 2021 00:34:54 GMT

Thanks for well explanation and reply

I have software valid for 16 more days, I will work on it