Splunk Alert query syntax

mike_k — Fri, 21 May 2021 07:54:18 GMT

I am just starting off with configuring up some Alerts in my Splunk environment.

One of the alerts that i have configured up as a test is to run a scheduled test once a day, looking to see whether any of the Cisco switches in my environment has restarted. I've configured up the following search:

index=<my_index> "%SYS-5-RESTART" | stats count

When using this as a simple search, this seems to work well, letting me know accurately if a switch has rebooted within the search time window. However with the alert that i have created from this search, it seems to be sending out an email regardless of the search result.

The Alert configuration i have used is as follows:

Alert Type: scheduled (run everyday at 5pm)
Expires 24 hours
Trigger alert when: Number of Results is greater than 0
Trigger: once
Trigger Actions: Send email

even today, when i used the above search term for the last 24 hours, it is coming up with a count of 0 and yet Splunk is still forwarding out an email at 5pm. Is there something that i am missing with the alert syntax?

Thanks,

Re: Splunk Alert query syntax

ITWhisperer — Fri, 21 May 2021 08:20:50 GMT

Your search is returning a result (count = 0) - add "| where count > 0" to your search so results are only returned when there is something worth alerting

Re: Splunk Alert query syntax

mike_k — Mon, 24 May 2021 01:24:58 GMT

thanks, that did the trick.

topic Splunk Alert query syntax in Alerting

Splunk Alert query syntax

Re: Splunk Alert query syntax

Re: Splunk Alert query syntax