topic How to achieve event logs report if threshold match? in Monitoring Splunk

How to achieve event logs report if threshold match?

cbiraris — Thu, 05 Jan 2023 20:19:52 GMT

Hi Team,

I am looking for the help for the Event logs report if threshold match.

I tried both way with creating a report and alert. but it either send me logs using |table _time, _raw method or sending count using |stats count | where count >0

I need to schedule last 24hrs data report like, only if there is a event at 00:00 AM.

Please guide me

Thank you

Re: Event logs report if threshold match

PaulPanther — Thu, 05 Jan 2023 14:42:22 GMT

Hello cbiaris,

what is your exact problem and which goal you wanna reach?

Would be great if you can provide some more information.

My current assumption is that you wanna run a scheduled search only in that case if there are 1 or more events at a specific time.

Re: Event logs report if threshold match

cbiraris — Thu, 05 Jan 2023 15:29:27 GMT

I am trying to create scheduled report or alert whichever useful to send CSV file containing search event logs.

Suppose,

Index=ABC sourcetype=XYZ "failed to run"

if there "failed to run" event present more then "0" count in last 24hrs alert or report should trigger at 12AM.

and alert or scheduled should have CSV file attached in mail notification containing search event log.

Re: Event logs report if threshold match

PaulPanther — Thu, 05 Jan 2023 15:41:32 GMT

Based on Alert examples - Splunk Documentation do it like:

From the Search Page, create the following search.

Index=ABC sourcetype=XYZ "failed to run"  earliest=-24h latest=now

Select Save As > Alert.
Specify the following values for the fields in the Save As Alert dialog box.
- Title: Errors in the last 24 hours
- Alert type: Scheduled
- Time Range: Run every day
- Schedule: At 00:00
- Trigger condition: Number of Results
- Trigger when number of results: is greater than 0.
Select the Send Email alert action.
Set the following email settings, using tokens in the Subject and Message fields.
- To: email recipient
- Priority: Normal
- Subject: Too many errors alert: $name$
- Message: There were $job.resultCount$ errors reported on $trigger_date$.
- Include: Link to Alert, Attach CSV, Inline... and Link to Results