About Sandy

Sandy · ‎07-11-2022

Thank you for this query, but it will show all the reports and alerts. Actually i want to create an alert which will trigger if any user create one alert or report in splunk.

Sandy · ‎07-11-2022

Hi, I want to create an Alert which will trigger when any user created new alert or report in our environment. So could you please help me with suitable query for this.

Sandy · ‎01-27-2022

Pleas find the exact requirement below: Consider same hosts like (Host1, Host2, Host3) and sourcetypes like (abc, def, xyz) which have a reporting table as below, Host Name Sourcetype Reporting Host1 abc, xyz Host2 xyz Host3 abc, def, xyz Here, as you see, Host1 & Host3 are reporting to other sourcetype as well apart from xyz. I want to filter the host having only xyz as the sourcetype. So, in this case it would be Host2.

Sandy · ‎01-27-2022

Hi Jotne, We see that for all the host it is showing as 0 only, could you please guide me what changes required.

Sandy · ‎01-27-2022

Hi, There is some host which is reporting to Splunk with a different sourcetype. We want to filter all the host which is only reporting for XYZ sourcetype. And host needs to be shown if it's reporting for XYZ sourcetype along with any other sourcetype. could you please help us on this query.

Posts	5
Solutions	0
Karma Given	3
Karma Received	0
Member Since	‎10-21-2021

Online Status	Offline
Date Last Visited	‎07-11-2022 11:20 AM

How to create Alert for when a user newly creates ...

Sourcetype Identification

Re: Alert for newly created Report/Alert

How to create Alert for when a user newly creates ...

Re: Sourcetype Identification

Re: Sourcetype Identification

Sourcetype Identification