Splunk Search

How to generate the alerts on specific condition

sachindarade
New Member

Hi All,

I am new to Splunk.. Here is my requirement.. I have pass log directory to forwarder. Now i want to read the logs and generate the alerts when log file contains "file(s) count is 2" or greater than 1. (condition is : File(s) count is greater than 1)

your help would be really appreciated.

Thanks in Advance.

0 Karma

sumanssah
Communicator

maybe you can try

| tstats count where index=<your_index_name> by source | where the count > 1
0 Karma

woodcock
Esteemed Legend

Show the content of the log.

0 Karma

sachindarade
New Member

02/26/2020 09:02 AM .
02/26/2020 09:02 AM ..
02/17/2020 02:43 PM Archive
02/17/2020 06:47 PM 71 queuelog.bat
1 File(s) 71 bytes
3 Dir(s) 413,241,344 bytes free

Here is the log...

you can see that "1 File(s)"... so i have to parse the log content and look for the file count.. if files count is grater than 1 then i wanted to generate the alerts.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...