Solved: How to create an alert when process appears in mul...

agentsofshield · ‎09-04-2018

Say I have a table of processes and IP addresses. I want to make an alert when a certain process was monitored in multiple computers during the last 24 hours. How can I do it?

Very specific question I know, I just didn't know how to phrase it otherwise.

renjith_nair · ‎09-04-2018

@agentsofshield,

Try

your search|fields process,ipaddress|stats dc(ipaddress) as count,values(ipaddress) as ipaddress by process|where count >1

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair · ‎09-04-2018

@agentsofshield,

Try

your search|fields process,ipaddress|stats dc(ipaddress) as count,values(ipaddress) as ipaddress by process|where count >1

---
What goes around comes around. If it helps, hit it with Karma 🙂

How to create an alert when process appears in multiple IPs?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Reuse: Word-play

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

Best Practices: Splunk auto adjust pipeline queue

Join the Conversation