Deployment Architecture

More than 100 “EventID=8306 sourcetype="xyz"” in 15 minutes on an individual host base

mvishal
Explorer

i want an alert setup in splunk for 100 occurrence of event id 8306 per host for sourcetype "xyz" in 15 minutes..

Can anyone suggest ??

Tags (2)
0 Karma

sc0tt
Builder

What about something like sourcetype="xyz" EventID=8306 | stats count by host | where count > 100 then schedule it to run every 15 minutes for the previous 15 minutes, start time = -15m@m finish time = @m?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...