Take a look at the following alert actions. https://splunkbase.splunk.com/app/3226/ https://github.com/rzzldzzl/alert_webhook_ng Joe ... View more

Take a look at the following alert actions. https://splunkbase.splunk.com/app/3226/ https://github.com/rzzldzzl/alert_webhook_ng Joe ... View more

The following worked for me. $ splunk search 'index=_internal | stats count' -index_earliest 1493132552 -index_latest 1493404081 -sample_ratio 1000 INFO: Sampling disables usage of report acceleration summaries. INFO: This search is sampling approximately 1 out of every 1000 events (seed=1317954456) count ----- 58 $ curl -sku user:pass https://localhost:8089/services/search/jobs/export --data-urlencode search='search index=_internal | stats count' -d output_mode=csv -d earliest_time='1493132552' -d latest_time='1493404081' -d sample_ratio='1000' count 46 ... View more

I wrote a command to do this. I uploaded it to github: https://github.com/rzzldzzl/splunk_dec2ip_command Example: $ splunk search '| stats count | fields - count | eval dec_ip="739840322" | dec_ip ip4' dec_ip ip4 --------- ----------- 739840322 44.25.17.66 Joe ... View more