Splunk Enterprise Security

generating 5 individual notables events for single search but i need one notable event for all the search results

vikkysplunk
Path Finder

Hi all,

 

Using the below SPL i have created one new use case for multiple emails sent from external domain. For example if i get 5 results in search it is generating 5 individual notables events but i need one notable event for all the 5 results .. pls could you help me on these

index=msexchange sourcetype=MSExchange*:MessageTracking tag=email action=delivered sender_domain!=@x.x.x recipients!=@x.x.x | stats dc(recipient) as count by sender | search count >=4 | rename count as recipient_count | table sender recipient_count

Search Range 1hr

Cron schedule : */5 * * * *

Labels (2)
0 Karma
1 Solution

ITWhisperer
Legend

Your count appears to be by sender not sender_domain, could that be why?

View solution in original post

0 Karma

ITWhisperer
Legend

Your count appears to be by sender not sender_domain, could that be why?

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.