How to create Splunk alerts?

[ish]

i need to set email alerts for malicous activites  in Splunk 

I also need to set  all security measures  for enterprise server

Please help

[richgalloway]

Those are two vague statements that should be separate postings.

To create an alert, start with a search.  Find the condition that will trigger the alert, whatever that may be.  When you're happy with the search results, click the Save As link and save it as an alert.  See https://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts for details.

The second question is far too broad and vague to address.

[ish]

Thanks so much for reply

I  just start learning Splunk

I want to know if i don't have any existing data  for search, Do I have to create new search?

How I add data about malicous activities as new search

how I will set alerts goes to my  email

Thank===

[richgalloway · Accepted solution]

If you don't have any data then you have nothing to search.  Add data then search it.

If we could add data only about malicious activities then our jobs would be much easier.  Instead, we have to add the data we have and then search it for indications of suspected malicious activity.  What data to add depends on what you have and which activities you care about.

Once you have a working search and save it as an alert then Splunk will ask what you want to do with the alert.  One of the options is to send email.  See the manual cited above.

[ish]

Thanks  for well explanation and reply

I have software valid for 16 more days, I will work on it