topic Splunk Alert in Alerting

Splunk Alert

sarahnazzar — Mon, 18 Feb 2019 09:31:01 GMT

Hello Splunkers,

I'm having an alert with last 3 days as the time range and that alert is triggered everyday at a particular time showing the last 3 days data.. Now the thing I need is, the alert should be triggered when it is having data for the current day and it should not trigger if it is having data for the previous days.. in addition to this condition, when the alert is having data for the current day then I must get the previous days data too no matter what..

Note: My search time range must be last 3 days.. is that possible?

Thanks in advance!

Re: Splunk Alert

renjith_nair — Mon, 18 Feb 2019 12:06:35 GMT

@sarahnazzar ,

Try this and see if it fits your requirement.

"your current search"
|eval date=strftime(_time,"%Y-%m-%d")
|eventstats dc(date) as noOfDays,max(_time) as latest_date
|eval latest_date=strftime(latest_date,"%Y-%m-%d")|eval current_date=strftime(now(),"%Y-%m-%d")
|where latest_date==current_date AND noOfDays>=3

This would give you results if latest date in the result is current date and if you have atleast 3 days of data in your results.

Re: Splunk Alert

sarahnazzar — Tue, 19 Feb 2019 05:59:08 GMT

Thanks for the help! It's working fine..