hi, I want to create an alert that will trigger when 1 user (no specific user name, just one persong from the organization), deletes more than 5 files from DropBox.
I tried setting the following query:
host="ip-of-the-host-as-arrives-in-splunk" "event_type..tag"=file_delete | where count > 5
but how do I add the 1 user part ?
will love to get some help, I am new at this
What information do you have in your events?
I have all information relating the user, user name, email address, ip, action, id, etc...
| stats count by user