Is there a way i can create custom notification triggers in Splunk?

[sabdulkader]

Is there a way i can create custom notification triggers in Splunk?

For example, if a restart of the server is initiated or a software is installed on the servers etc.

And it would send an email automatically informing the same. Please help

Thanks & Regards,
Siraj

[mstjohn_splunk]

hi @sabdulkader

Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[victor_menezes · Accepted solution]

Hi,
I believe you could create a query to the sourcetype=Wineventlog looking for an event that would represent a system reboot information. The event id 6006 tells you that event log service was shut down, which may represent a server reboot. For installed applications, the event id 11707 is for MsiInstaller and may help you to identify some.

With that query in hands and tested, just save it as an alert and set it as you wish, configuring the trigger action to send you a mail.