topic Re: Alert not triggering as expected? in Splunk Enterprise

Why is alert not triggering as expected?

Vani_26 — Thu, 03 Nov 2022 16:22:54 GMT

Hi, i got the below query, and alert should get triggered only when data is not avaiable from any one of the host_ips

i gave the time range as 24 hrs to now and alert condition = o and corn expression */30 * * * *

i am getting mail for every 30 mins, even if data is available.

index=advcf request=* host IN(abgc, efgh, jhty, hjyu,kjnb)
| eval event_ct=1
| append [| makeresults 
    | eval host="abgc, efgh, jhty, hjyu, kjnb"
    | rex field=host mode=sed "s/\s+//g"
    | eval host=split(host,",")
    | mvexpand host
    | eval event_ct=0
    ]
| stats sum(event_ct) AS event_ct BY host
| where event_ct=0

Re: Alert not triggering as expected?

ITWhisperer — Thu, 03 Nov 2022 16:21:01 GMT

There doesn't appear to be anything wrong with your search - can you share your alert configuration?

Re: Alert not triggering as expected?

Vani_26 — Thu, 03 Nov 2022 16:36:15 GMT

alert configuration means, like what you want me to share.???

Re: Alert not triggering as expected?

ITWhisperer — Thu, 03 Nov 2022 16:43:01 GMT

Something like this

Re: Alert not triggering as expected?

Vani_26 — Thu, 03 Nov 2022 17:45:05 GMT

Re: Alert not triggering as expected?

richgalloway — Thu, 03 Nov 2022 18:53:42 GMT

I believe you want the alert to trigger is the number of results is NOT zero. That is the error condition.

Re: Alert not triggering as expected?

Vani_26 — Thu, 03 Nov 2022 19:17:33 GMT

My requirement is that i should receive the mail when no data is available in the servers.
So my condition should be equal to 0 right???

Correct me if i am wrong.

Re: Alert not triggering as expected?

richgalloway — Fri, 04 Nov 2022 00:20:24 GMT

The test for zero is already in the SPL

| where event_ct=0

so you want the alert to trigger when the SPL finds a zero count for a host. Therefore, trigger when the number of results is not zero.

Re: Alert not triggering as expected?

Vani_26 — Fri, 04 Nov 2022 00:31:44 GMT

So in the alert configuration, i need to mention number of results "is not equal to 0"
Please confirm.

Re: Alert not triggering as expected?

Vani_26 — Fri, 04 Nov 2022 01:38:03 GMT

thank you, it worked