Solved: Re: How to create an alert when process appears in...

agentsofshield · ‎09-04-2018

Say I have a table of processes and IP addresses. I want to make an alert when a certain process was monitored in multiple computers during the last 24 hours. How can I do it?

Very specific question I know, I just didn't know how to phrase it otherwise.

renjith_nair · ‎09-04-2018

@agentsofshield,

Try

your search|fields process,ipaddress|stats dc(ipaddress) as count,values(ipaddress) as ipaddress by process|where count >1

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair · ‎09-04-2018

@agentsofshield,

Try

your search|fields process,ipaddress|stats dc(ipaddress) as count,values(ipaddress) as ipaddress by process|where count >1

---
What goes around comes around. If it helps, hit it with Karma 🙂

How to create an alert when process appears in multiple IPs?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

Best Practices: Splunk auto adjust pipeline queue

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation