Alerting

How to create an alert via geostats count by Country

lukeasplunk
Observer

I am trying to create an alert based on sourcetype=iis | iplocation True_Client_IP | geostats count by Country that if one of my true client IPs show up in a Country where its not supposed to be it will generate an alert with the IPs listed.

I think I would some how need to input a list of locations that would trigger such an alert.  Any help on how to create such an alert would be appreciated.

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you just need an alert then geostats isn't necessary.  The iplocation command returns country names which you can then use in a normal stats command.

sourcetype=iis 
| iplocation True_Client_IP 
| stats count by Country
| where NOT Country=="United States"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Buttercup Games Tutorial Extension - part 9

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games Tutorial Extension - part 8

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Introducing the Splunk Developer Program!

Hey Splunk community! We are excited to announce that Splunk is launching the Splunk Developer Program in ...