Splunk Search

I'm new to splunk queries and how to create an alert using Linux commands on Splunk?


I need to write a Splunk alert to check number of connections on a server. Using below Linux command I can get the results on the server. But help me out in creating an alert on Splunk with the command.

ps -ef | grep '[s]shd' | grep -v ^root | grep -i file* | wc -l

Labels (2)
0 Karma


That's a pretty straightforward query in Splunk.  However, do you have the equivalent to "ps -ef" logged in Splunk?  If not, then the alert won't work.

Another option is to create a scripted input that executes that CLI command and logs the result in Splunk.  Then you can alert on it.

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...