Splunk Search

Creating a search that will fetch 10 unique repository that perform an action in the last 10 minutes

wailoont
Engager

Hi Splunk,

I am in trying to create an alert that will send email to users if the search query returned results if there is 10 unique repository returned in the events.

search_query earliest=-10m@m latest=now
| stats count by repository| where count > 9 | sort - count

Currently, the alert trigger if there is an occurence of 10 times of the SAME repository. I want to improve the query by triggering alert if only there is 10 DIFFERENT repository.

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could use stats dc(repository) and trigger when that is 10 or more, or stick to stats count by repository and set the alert trigger to only trigger if the result count is 10 or more.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...