topic Splunk query to Check when no value is returned in Splunk Dev

Splunk query to Check when no value is returned

masmi99 — Wed, 18 Aug 2021 19:15:19 GMT

Scenario:

Example query : index=XXXX name=somefile | stats count(msg) as MESSAGE

The above query will always return some count.

I want to alert if the Message=0 for two consecutive 5 min interval over the last 15 min interval i.e. when no values are returned.

earliest=-15m if two out of three interval (5min) the message=0 i want to take some actions

Re: Splunk query to Check when no value is returned

codebuilder — Wed, 18 Aug 2021 19:26:37 GMT

Just add this to the end of your alert query:

| where result_count=0

Re: Splunk query to Check when no value is returned

masmi99 — Wed, 18 Aug 2021 19:32:05 GMT

when i add where MESSAGE=0 it is not returning any result

As my intention is to check for last 15 min if two of 5 min interval does not get any result to do some other action

index=XXX name=file-XXX level<50
| bucket _time span=5m
| fillnull value=0
| stats count(msg) as MESSAGES by _time

tried this but this will provide the result as follows it skipped 3:25 when the count was 0

2021-08-18 03:20:00	25
2021-08-18 03:30:00	139
2021-08-18 03:35:00	10

Re: Splunk query to Check when no value is returned

codebuilder — Wed, 18 Aug 2021 20:24:00 GMT

The problem with you query is that you are not eliminating events where "msg" has a non null value. That's why youre getting results with counts.

Try something like this: