Alerting

Help creating alert criteria

jedatt01
Builder

I want to create an alert that will fire if Splunk see's a log message from two seperate sources in a 10 minute interval. For example one event from Source1 and one event from Source2. The problem i'm running into is that Source2 may send more than one event in a ten minute interval, but I only want the alert to fire if it see's at least one message from source1 and source2 in ten minutes. Anyone have any ideas?

Tags (1)
0 Karma
1 Solution

Ayn
Legend

How about using dedup? In your search:

... | dedup source

and then create the >=2 events alert condition as usual.

View solution in original post

0 Karma

Ayn
Legend

How about using dedup? In your search:

... | dedup source

and then create the >=2 events alert condition as usual.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...