Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Query to capture distinct source IP who triggered multiple signatures

$
0
0
Dear Experts, I require help to create the query. I am creating the rule if single(unique) source triggered distinct signature(more than 2) . Than only we should get the result. Fields involved src,signature,count Thanks in advance

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>