Splunk Enterprise Security

How to create a cron-scheduled alert that triggers a mail with the notable event, urgency and triggered time?

paul96
New Member

I was trying to create a cron-scheduled alert in Splunk, that would trigger a mail with the notable event, urgency and trigger time.
I tried it by using |es_notable_events, but it returns a large amount of data.

Is there any other solution?

0 Karma

jawaharas
Motivator

Try below suggestions:

  1. Increase the frequency of alert - say every 30 minutes or even lesser. So, that number events for that time period will be less.
  2. Or Configure the alert mail to send the email with 'Attach CSV' option instead of populating search results in email body.
0 Karma

jawaharas
Motivator

@paul96
Can you accept the answer if it's helped you? Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...