topic Re: Alert on Count and print a table in Alerting

Alert on Count and print a table

varunghai — Tue, 29 Sep 2020 17:43:37 GMT

Hi,

I want to create an alert where, I want to raise an alert if the count of total number of errors is greater than 10, then i want to print a table with error count on each host.

Query -
index=weblogs host="nlhypsewb*.*" sourcetype=web "The timeout specified has expired" earliest=-15m
| stats count(host) as COUNT
| where COUNT > 4

This query gives me correct results but it only gives me a column with total count
But when this query is giving some results then i want to generate an email which shows the count of errors on each host. How do I add those details in this query without using a Case if possible? I want to know if there is another option apart from using a switch Case.

Re: Alert on Count and print a table

mayurr98 — Tue, 16 Jan 2018 10:19:11 GMT

hey you can try something like this
If you want to see error count on each host then you should write

index=weblogs host="nlhypsewb*.*" sourcetype=web "The timeout specified has expired" earliest=-15m 
| stats count(host) as COUNT by host 
| eventstats sum(COUNT) as total_count | where total_count>10 | fields - total_count

let me know if this helps!

Re: Alert on Count and print a table

varunghai — Wed, 17 Jan 2018 03:40:40 GMT

Hi Mayur, thanks for your answer, but using this query the fnal output table will be based on count per host so if for eg- host1 has count 11 and host2 has count 2 it will show only the host with count 11, which may lead to misinterpretation of the alert as the alert condition is when total number of errors overall on all the hosts is greater than 10.

Re: Alert on Count and print a table

mayurr98 — Wed, 17 Jan 2018 03:54:28 GMT

Hey yeah i got it. I have changed my query pls check and let me know.. i have set the threshold on the total number of count !