Splunk Enterprise Security

How to create an alert that triggers when field value status changes?

mahendra559
New Member

Actual requirement is when a status field value changes from one to another, an alert needs to be triggered.
Below are the status field values:

Extended recovery
Investigation suspended
False-positive
Investigating
Service degradation
Service restored
Restoring service
Post-incident report published

Ex: If status field value changes from "false-positive" to "investigating" then alert should be triggered.
If field value changes from "false-positive" to "false-positive" then no alert should be triggered.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...