Hi guys, I've seen similar questions and answers but can't get around them. My question is simple... I guess.
I am searching antivirus logs to see if the scan is being run daily. If it is not, then I would like to register and alert in Splunk. My search is as follows:
host=server2003-splu sourcetype=fs_notification index=_audit Defender\\Scans\\History action=update | stats count
I would like a way to have an alert if count = 0
Thanks for any help
Instead of computing the count yourself you can create an alert that runs daily and is triggered if the number of results is equal to zero.
Instead of computing the count yourself you can create an alert that runs daily and is triggered if the number of results is equal to zero.
Thanks so much, I knew it had to be something simple, my bad
PS: I've tried | where count<1 but that doesn't seem to work