Splunk Newbie

[markbudman]

Hello,

I am a Splunk newbie and I am having issues using this software.

I have gone through documentation, but I still find it challenging.

For instance, how does one modify the code that generates an existing search? I have a search alert called "Test"

I can change what happens when the alert is triggered, but do not see how to modify the actually search code (for lack of a better word). I only see save As as Save is whited out.

The person who worked with Splunk prior to me created a dashboard that listed servers and the number of times each server appears within a specified period.

I would like to create an alert, where if a new server appears, an email alert is sent out if there are more than 100 lines (or logs generated for this particular server)  within an hour period for this new server.

Email configuration is fine and works as desired. Can someone guide me as to how to create such an alert? Is there a way to use the code that generates the Dashboard?

Any assistance would be greatly appreciated. I have only been working with Splunk for 2 days.

Thanks in advance!

Mark

[richgalloway]

Mark,

Start by taking the free Splunk Fundamentals 1 course.  That will help to get you oriented.  See https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

Since you inherited your Splunk from someone else, give this document a read. https://docs.splunk.com/Documentation/Splunk/8.1.0/InheritedDeployment/Introduction

Beg your boss for proper Splunk Admin training.

Inability to make changes usually indicates a permission problem.  Are you signed in as an Admin or a user?

Is this an on-premises Splunk or Splunk Cloud?

[markbudman]

Oops. I should have mentioned that this is on premise Enterprise Splunk, version 8.x

I sign is as Admin.