Alerting

Alert to show if a Users data level goves over 1GB

DDewarSplunk
New Member

Afternoon Splunk Gurus

I am trying to create an alert, where as if a users data (Bytes_out) goes over 1GB then I get an email.

So far I can list the users as per below but am now struggling to define only data over 1GB and get the alert to send me an email (Like a table) with user name PC Name Etc Etc

Any help would be really appreciated.

Thanks

D

sourcetype="traffic" eventtype="traffic"
| stats sum(bytes_out) by user src_ip app app:subcategory eventtype
| dedup user, src_ip, app, app:subcategory
| rename sum(bytes_out) as sbo
| eval "MegaBytes"=((sbo)/1024)/1024
| fields - sbo
| sort -"MegaBytes"
| sort -total | head 10

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

hey @DDewarSplunk

You can define your condition in the query itself and just create an alert

sourcetype="traffic" eventtype="traffic" 
| stats sum(bytes_out) by user src_ip app app:subcategory eventtype
| dedup user, src_ip, app, app:subcategory
| rename sum(bytes_out) as sbo 
| eval "MegaBytes"=((sbo)/1024)/1024 
| fields - sbo
| sort -"MegaBytes" 
| sort -total | where MegaBytes>1024

Let me know if it works!

View solution in original post

mayurr98
Super Champion

hey @DDewarSplunk

You can define your condition in the query itself and just create an alert

sourcetype="traffic" eventtype="traffic" 
| stats sum(bytes_out) by user src_ip app app:subcategory eventtype
| dedup user, src_ip, app, app:subcategory
| rename sum(bytes_out) as sbo 
| eval "MegaBytes"=((sbo)/1024)/1024 
| fields - sbo
| sort -"MegaBytes" 
| sort -total | where MegaBytes>1024

Let me know if it works!

DDewarSplunk
New Member

Ahh Thanks....I t I was over thinking \ complicating it !!
Keep it nice and simple is the secret !

Thanks very much Mayurr98

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...