Our requirement is to raise a Splunk notification to EVERY EVENT. How to achieve this?
Elaborate explanation: Consider below two entries are two events
xxx.xx.xx.xxx - - [01/Jul/2009:12:05:27 -0700] "GET /
trade/app?action=logout HTTP/1.1" 200 2953
xxx.xx.xx.xxx - - [01/Jul/2009:12:04:30 -0700] "GET /
trade/app?action=logout HTTP/1.1" 200 2953
I would like to raise a Splunk notification (in our case its ticket) for above two events (strictly speaking all the events).
Any suggestion would be appreciated.
You could schedule an alert searching for index=yourdata
and configure your alert actions accordingly. That would alert whenever there's data in that index with no further filtering.