Anvilogic medium experimental spl

Kubernetes Update Pod Configuration [splunk-unix]

This use case looks for when a pod configuration has been modified with kubectl-edit, scale, autoscale, or replace.

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_unix` (TERM(kubectl) (TERM(edit) 
OR TERM(scale) 
OR TERM(autoscale) 
OR TERM(replace)))
| table _time, host, user process, process_*
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...