Alert Configuration

[ipirzada_22]

Would like to configure an alert that will trigger based on the action and subcategory below.  Would like this to run hourly to check if there are any hits daily.

action=update subcategory=WEB_DLP_POLICY

[livehybrid]

Hi

There isnt quite enough info in the post to work out exactly what you need - however the following should get you started. Note: I wouldnt recommend looking back 24 hours every time, what is the reason for this? I would recommend just looking back 60 minutes, you could use earliest=-70m latest=-10m to make sure you get data which is up to 10 minutes late arriving.

Run a search which returns the events you want to be alerted on:

index=your_index action=update subcategory=WEB_DLP_POLICY earliest=-1d@d latest=now

Click Save As-> Alert.

Name the alert and change the settings to make it run hourly. 

You'll need to make sure you apply some throttling because otherwise you may get the alerts duplicated every time it runs.

Then scroll down and setup your chosen Alert action - presumably Email? Configure this according to your requirements and then save.

Some useful docs: https://docs.splunk.com/Documentation/Splunk/9.4.1/Alert/Definescheduledalerts

🌟Did this answer help you? If so, please consider:

• Adding kudos to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[richgalloway]

What have you tried so far?  Where did you get stuck?

Why check the whole day every hour?  If nothing was found in the 00:00-01:00 period at the 01:00 run then nothing will be found in the same period at the 02:00 run.  Searching the same data repeatedly is a waste of resources.