How do you generate an alert on a specific condition?

[sachindarade]

Hi All,

I am new to Splunk.. Here is my requirement.. I have pass log directory to forwarder. Now i want to read the logs and generate the alerts when log file contains "file(s) count is 2" or greater than 1. (condition is : File(s) count is greater than 1)

your help would be really appreciated.

Thanks in Advance.

[manjunathmeti]

If you are checking number of files created in log directory then use this query.

index=<index_name> | stats count by source | where count > 1