topic Re: field value occurence treshold in Alerting

field value occurence treshold

HansK — Mon, 28 Sep 2020 12:01:24 GMT

I want to create an alert with a certain treshold

I have this query:
host="abc0*" DN=* NOT DN="45643232*" NOT DN="53222455*"

Any time a distinct DN occurs more than 10 times per second I would like to be alerted.

How can I set this up?

rturk — Wed, 04 Jul 2012 13:09:59 GMT

Using the _internal index, here's the best approximation I can give you (my server name is "Voyager-2"):

index=_internal | timechart span=1s count by host | search Voyager-2>10

So in your case, something like this should do the trick:

host="abc0" DN= NOT DN="45643232" NOT DN="53222455" | timechart span=1s count by host

Then you create an alert based on your saved search that will trigger if the number of results is greater than 10.

Hope this helps 🙂

HansK — Wed, 04 Jul 2012 13:17:58 GMT

host="abc0" DN= NOT DN="45643232" NOT DN="53222455" | timechart span=1s count by DN

This comes closer than I was, but this will alert if the occurence of DN is higher than 10 per second.

DN can hold many values, I need it to alert when a distinct value occurs more than 10 times per second.

Thanks for helping though

rturk — Wed, 04 Jul 2012 13:37:58 GMT

Ahh in that case, try this:

host="abc0" DN= NOT DN="45643232" NOT DN="53222455" | timechart span=1s dc(_raw) by DN

HansK — Wed, 04 Jul 2012 13:57:02 GMT

hmm, still alerting when there are 10 occurence of any DN, not when a single DN is >10