I am new to Splunk.. Here is my requirement.. I have pass log directory to forwarder. Now i want to read the logs and generate the alerts when log file contains "file(s) count is 2" or greater than 1. (condition is : File(s) count is greater than 1)
your help would be really appreciated.
Thanks in Advance.
If you are checking number of files created in log directory then use this query.
index=<index_name> | stats count by source | where count > 1