Splunk Alert

[jdrogers83]

I want to create an alert that will email us if we see any traffic that is not from a.b.c.d network communicating with w.x.y.z network (source or destination). I know I'm for sure missing stuff.

Thank you to any help!
Justin

[diogofgm]

Use this
index=nettraffic NOT ((source="a.b.c.d" dest="w.x.y.z") OR (dest="a.b.c.d" source="w.x.y.z"))

[saagar203]

query data with NOT keyword i.e. index="your index" NOT source="x.x.x.x" AND destination="x.x.x.x". Trigger alert when Number of records > 0 or whatever threshold.