About SomnathShilimka

SomnathShilimka · ‎09-25-2014

Hi, above search gave me 3 results (as we have used stats command) and around 39 matching events. per my understanding this time it should have generated 3 alerts (as number of results is 3), but still it is showing me only one alert in alert manager. I saw splunk education video for alerting in which they have said if you want alert for each result then select For Each in actions. but unfortunately this is not happening. Thanks & Regards, Somnath

SomnathShilimka · ‎09-25-2014

Hi, Thanks for the reply. i am new to Splunk therefore not very much skilled in it, I have added above command suggested by you but it did not help. i am trying below search. sourcetype=access_combined* status=404 over 5 minutes it gives me around 15-20 matching events, therefore i decided to create an alert(scheduled alert) which will generate 15-20 alerts (one alert for each). but somehow it shows me only one alert after 5 minutes. Please help me in it. how can i achieve getting same number of alerts as number of events matched ? Regards, Somnath

SomnathShilimka · ‎09-25-2014

Hi All, I am using Splunk 6 and below is the issue i am facing. i have setup an alert (scheduled alert) for 5 minutes time. As per my search string during that 5 minutes i can see around 16 events are generating. while creating an alert i have selected Per Result as execution action. means for 16 events 16 alerts must get generated. but when i check after sometime(5-6 minutes), i can see only one alert representing 16 events. ideally there should be 16 alerts generated. but in my case this is not working. i tried it on Splunk 5 too but same issue. Please explain why this is happening ? Thanks & Regards, Somnath

SomnathShilimka · ‎12-10-2013

Hi All, I would like to know is Splunk right tool for Security Event Management ? Regards, Somnath Shilmkar

SomnathShilimka · ‎04-30-2013

Hi Martin_mueller thanks for reply, i know for splunk no need of separate DB, what i want to know is :- what is name of that Splunk-built database(data structure) ? Regards, Somnath

SomnathShilimka · ‎04-30-2013

Hi All, i am newbie in splunk, i searched over documentation and also over community. but i did not get answer for question in my mind. Question is :- What database Splunk uses to work ? like Oracle or MySQL or PostgreSQL ? i also read one already posted question as provided on below link http://splunk-base.splunk.com/answers/32499/what-database-engine-splunk-uses on same link, in answers it is written like below :- I am not sure what is unclear to you in the previous answer. Splunk uses it's own engine, and does not rely on any external databases in order to operate. It manages its own database via a series of flat files and indexes, and Damien has provided a few good resources for you to have an idea on how the data engine works. does it means Splunk do not use any database like Oracle or MySQL etc ? thanks & regards, Somnath

SomnathShilimka · ‎04-02-2013

thanks pero. problem was, i was not putting space after each asterisks

SomnathShilimka · ‎04-02-2013

thanks pero. problem was, i was not putting space after each asterisks

SomnathShilimka · ‎04-02-2013

Hi All, I am getting invalid cron_schedule =5/*** error while i m trying to create a schedule search for every 5 minutes. same problem i am facing while i am trying to create alert for every five minutes. i am using Partner Kit for Splunk 5 for windows 7 kindly help in this. Regards, Somnath Shilimkar

Posts	9
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎04-02-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Why am I not getting an alert for each matching ev...

Can Splunk be used for Security Event Management ?

What underlying database Splunk uese to operate?

invalid cron_schedule= *5/****

Re: Why am I not getting an alert for each matchin...