Splunk Search

Create Alert if condition is met?

Chinni611
Loves-to-Learn Lots

Hi , 

I have a scenario where the files needs to be transferred for both inbound and outbound at 2 am daily. 

I need to create an alert when files are present in inbound by 2 am but missing in outbound by 2 am . 

Here is my query below. please help 

index=cas source="/bin/var/logs/log"  File 1OR File 2 OR File 3 OR File 4 Inbound 

for outbound condition is to change to outbound and File 1 represents the file that is getting transferred 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Chinni611,

could you better describe how to recognize inbound from outbound?

in oher words; is there a string in one event? or there's a file with a different name?

Ciao.

Giuseppe

0 Karma

Chinni611
Loves-to-Learn Lots

differentiation is just by IP address for inbound (x.x.x) or not api - outbound is api.com address .File is same ( file is getting transported to both the places first inbound and later outbound) we need to track if file is present in inbound but missing in outbound at 2:01 am daily 

0 Karma

johnhuang
Motivator

Could you provide some sample data?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...