Solved: Rule creation in splunk - Splunk Community

Monitoring Splunk

Hi,

How to write a rule in splunk to monitor a particular ID

Another rule to monitor a particular IP address.

1 Solution

Solution

You can use conditional functions https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/ConditionalFunctions and create report/alert from it.

View solution in original post

Solution

You can use conditional functions https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/ConditionalFunctions and create report/alert from it.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers, So you searched, “what is the name of the usb key inserted by bob smith?” Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register Is your ...