This message originated from Cribl Community Slack.
Click here to view the original link.
Can we set up volume notifications on worker group level instead of source and destination?
Solved
Volume Notifications Not Configurable At Worker Group Level
Best answer by Jon Rust
Set up a catchall route in the WG at the top of the route table
Set it to NOT final
Send it to a pipeline that uses the agg function to collect timing and/or volume* info, optionally with dimensions to categorize host, source, etc
Send those resulting stats to your log analysis tier
Report and alert from there
use some of the concepts from this blog:
https://cribl.io/blog/where-have-you-gone-all-my-firewall-logs/
Set up a catchall route in the WG at the top of the route table
Set it to NOT final
Send it to a pipeline that uses the agg function to collect timing and/or volume* info, optionally with dimensions to categorize host, source, etc
Send those resulting stats to your log analysis tier
Report and alert from there
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.