Alerting

How to create an alert triggered by updated log data?

prakashv546
New Member

I am creating an alert. When alert is triggered, i want only the updated data in log file instead of entire log file, without using script.
I am using Splunk in Windows server 2012 R2.

Tags (2)
0 Karma

dineshraj9
Builder

You search should be able to filter the events which triggered the alert. In the alert settings, check on include results(csv, pdf, inline) and save. It should show you the events which triggered the alert.

0 Karma

prakashv546
New Member

I am looking for the data which triggered the alert..

0 Karma

koshyk
Super Champion

not understood what you mean by "I want only the updated data". You want a report to be sent from the log file? how do you define the alert? you looking for data which caused the alert to trigger?

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...