Alerting

How to edit my search to alert when the count is greater than 10000 and send me a list of the top 10 SRC_IP?

Path Finder

Can someone please help me finish an alert I am trying to do below? I would like to set the alert to notify me once the count reaches 10k and then send me a list of the top 10 SRC_IPs. However, when I put in the search count > 10000, it removed the src_ip entries.

Here is my search string so far.

sourcetype="cisco:asa" action=blocked | stats count by src_ip, dest_ip, dest_port  | sort - by count | rename src_ip as Src, dest_ip as Dest, dest_port as Port | addcoltotals
0 Karma

Splunk Employee
Splunk Employee

Use the custom condition in your alert :

where count > 1000
0 Karma

Path Finder

thank you, that worked on the alert. All I need now is to report the top x while keeping an "Other" count at the bottom.

0 Karma

Path Finder

I would also need the top 10 plus a line totaling the OTHER count as well.

0 Karma

Path Finder

Hi,

you could just set the number of results in the alert triggers wizard to 10000 events?

http://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Defineper-resultalerts

then just use something like

index = _internal | stats count by source | top limit=5 source

so you would have

my_awesome_search | top limit=10 Src

Cheers

0 Karma

Path Finder

Thank you.

But that the problem. When I put the 10k in the alert trigger, it's just like putting it in the search string where it then removed all other records. I would also need the top 5 plus a line totalling the OTHER count as well.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!