Splunk Enterprise

Create Notable Event/s Only Based on Number of Events


Hello, is it possible to create notables only based on the number of events triggered?
Example: If the correlation search result reached more than 20, I don't want it to trigger an notables, instead generate an email. 

is this possible?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...