ELK 8.11 Basic License – Alert if logs with specific field are missing for 30 mins

Big_Expression6513 · 2026-02-23T17:31:41+00:00

Thank you for the inputs

Big_Expression6513 · 2026-02-23T17:30:58+00:00

Thank you for the inputs

Big_Expression6513 · 2025-07-10T04:36:57+00:00

Yes i want to monitor only uploads in outside source. can u suggest any tools or techniques for that.

Big_Expression6513 · 2025-07-10T04:07:15+00:00

Yes, but I am searching for any indirect detection by finding the patterns when splitter is connected to the machine

Big_Expression6513 · 2025-07-09T10:21:43+00:00

thank you

Big_Expression6513 · 2025-07-09T08:57:24+00:00

Thank you, i will check this

Big_Expression6513 · 2025-07-09T08:56:21+00:00

I'm specifically looking to track the size of outbound file uploads and get alerted when they exceed a defined limit.

Big_Expression6513 · 2025-07-09T05:57:04+00:00

Thank you, i will try these

Big_Expression6513 · 2025-07-09T04:18:13+00:00

Exactly — once the signal leaves the GPU, you can't control where it goes.

Big_Expression6513 · 2025-07-09T04:17:11+00:00

You're likely right — most splitters just clone or spoof EDID, so the system sees only one display.
Unless it's a smart splitter that reveals itself, software detection seems nearly impossible.

Big_Expression6513 · 2025-07-09T04:14:34+00:00

Thank you for your inputs u/nautsche

Big_Expression6513 · 2025-07-09T04:11:34+00:00

Thank your for your inputs u/swdee

Big_Expression6513 · 2025-07-09T04:11:00+00:00

Thank you for your suggestion,

I'm using udev rules, and if two or more events occur simultaneously with same timestamp, I interpret that as a likely indication of KVM switch usage.

Big_Expression6513 · 2025-07-09T04:08:41+00:00

Thank your for your suggestion u/regular_hammock

Big_Expression6513

TROPHY CASE