Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Anyway to query past fired alert base on certain field?

$
0
0
Hi would like to check if this is possible: Lets say i have an 2 alert: alert A: check auth log for locked out in past 24 hour by ip alert B: check netflow log for upload > 10gb in past 24 hour by ip Is it possible for splunk to tell me x.x.x.x had trigger alert A on certain date, and trigger alert B on certain date when i query x.x.x.x? The goal is to tie past alert that had fired to certain field, be it an IP or an account name So i can easily check how 'suspicious' a user is based on his past triggered alert

Viewing all articles
Browse latest Browse all 47296


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>