Solved: Rule creation in splunk - Splunk Community

Monitoring Splunk

Hi,

How to write a rule in splunk to monitor a particular ID

Another rule to monitor a particular IP address.

1 Solution

Solution

You can use conditional functions https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/ConditionalFunctions and create report/alert from it.

View solution in original post

Solution

You can use conditional functions https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/ConditionalFunctions and create report/alert from it.

Get Updates on the Splunk Community!

Automated Threat Analysis: Available in ES Premier

Automated Threat Analysis: Centralize and Accelerate Phishing Investigations in Splunk Enterprise ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...