Is there a way i can create custom notification triggers in Splunk?
For example, if a restart of the server is initiated or a software is installed on the servers etc.
And it would send an email automatically informing the same. Please help
Thanks & Regards,
Siraj
Hi,
I believe you could create a query to the sourcetype=Wineventlog looking for an event that would represent a system reboot information. The event id 6006 tells you that event log service was shut down, which may represent a server reboot. For installed applications, the event id 11707 is for MsiInstaller and may help you to identify some.
With that query in hands and tested, just save it as an alert and set it as you wish, configuring the trigger action to send you a mail.
hi @sabdulkader
Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!
Hi,
I believe you could create a query to the sourcetype=Wineventlog looking for an event that would represent a system reboot information. The event id 6006 tells you that event log service was shut down, which may represent a server reboot. For installed applications, the event id 11707 is for MsiInstaller and may help you to identify some.
With that query in hands and tested, just save it as an alert and set it as you wish, configuring the trigger action to send you a mail.