Solved: How to create an alert when process appears in mul...

agentsofshield · ‎09-04-2018

Say I have a table of processes and IP addresses. I want to make an alert when a certain process was monitored in multiple computers during the last 24 hours. How can I do it?

Very specific question I know, I just didn't know how to phrase it otherwise.

renjith_nair · ‎09-04-2018

@agentsofshield,

Try

your search|fields process,ipaddress|stats dc(ipaddress) as count,values(ipaddress) as ipaddress by process|where count >1

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair · ‎09-04-2018

@agentsofshield,

Try

your search|fields process,ipaddress|stats dc(ipaddress) as count,values(ipaddress) as ipaddress by process|where count >1

---
What goes around comes around. If it helps, hit it with Karma 🙂

How to create an alert when process appears in multiple IPs?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Make your Splunk investment work harder with Optimization Advisor

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

Make Your Machine Data AI-Ready in Splunk

Join the Conversation