I am creating an alert. When alert is triggered, i want only the updated data in log file instead of entire log file, without using script.
I am using Splunk in Windows server 2012 R2.
You search should be able to filter the events which triggered the alert. In the alert settings, check on include results(csv, pdf, inline) and save. It should show you the events which triggered the alert.
not understood what you mean by "I want only the updated data". You want a report to be sent from the log file? how do you define the alert? you looking for data which caused the alert to trigger?
