hi, I want to create an alert that will trigger when 1 user (no specific user name, just one persong from the organization), deletes more than 5 files from DropBox. I tried setting the following query: host="ip-of-the-host-as-arrives-in-splunk" "event_type..tag"=file_delete | where count > 5 but how do I add the 1 user part ?   will love to get some help, I am new at this  ... View more

Hi, I am trying to create an alert that triggers when more than 5 files are deleted in less than 3 minutes from the app we monitor.  For some reason, the alert only works for single file deletion but does not work when I set it for. a number of events. any idea why? would love to get some help ... View more