Splunk Search

Alert based on same domain count

balcv
Contributor

We have email data reported in Splunk and I want to build an Alert, based on a search, that can trigger if it sees more then 250 events where the same email domain appears in the sender address.

For example, a flood of emails comes from [randomstuff]@uchc.edu among lots of other email traffic over a 30 minute period. I'm wanting the alert to trigger because it sees more than 250 events where the email domain is uchc.edu.

The alert needs to be able to identify the domain based on what is in the traffic and NOT a domain that is coded into the search.

Is this possible and is there any tips on how to create it. I apologize that I do not have any code to submit as I really do not know where to start.

Tags (2)
0 Karma
1 Solution

balcv
Contributor

I've figured it out. Not so hard when you put your mind to it.

index="*" 
| eval tmp=split(Sender,"@") 
| eval senderDomain=mvindex(tmp,1) 
| chart count by senderDomain 
| addtotals row=true fieldname=totalCount 
| where totalCount >= 150 
| fields - totalCount | sort -count

View solution in original post

0 Karma

balcv
Contributor

I've figured it out. Not so hard when you put your mind to it.

index="*" 
| eval tmp=split(Sender,"@") 
| eval senderDomain=mvindex(tmp,1) 
| chart count by senderDomain 
| addtotals row=true fieldname=totalCount 
| where totalCount >= 150 
| fields - totalCount | sort -count
0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...