topic Re: Alert custom condition in Alerting

Alert custom condition

dhivyamu — Wed, 30 Sep 2020 03:09:05 GMT

My alert search query is like this which runs every 5mins
index="iway_idoc" TMSG_TYPE="SAP_PLANARRIV" | table STATUS
the resultant records can have 2 different status - Delivered and Error

Now, I want to trigger an email if at-least one record with Error is found. I tried giving custom search like

search STATUS=Error
search count(eval(STATUS="Error")) > 1

It didn't work 😞

Can someone help in this please ??

Re: Alert custom condition

jaime_ramirez — Wed, 27 Nov 2019 16:15:41 GMT

Could you try this instead:

index="iway_idoc" TMSG_TYPE="SAP_PLANARRIV" 
| table STATUS
| search STATUS=Error
| stats count

This will count the records with STATUS=Error and then you can configure your alert to trigger if the count > 0.

For aggregate/statistical operations you should use stats command: https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Stats

Hope it helps!!!

Re: Alert custom condition

gcusello — Wed, 27 Nov 2019 16:21:56 GMT

HI @dhivyamu,
try something like this

index="iway_idoc" TMSG_TYPE="SAP_PLANARRIV" STATUS=Error

Alert must be triggered when results are grether than 0
In othe words: if you have results you have errors.

You could also add a command to display e.g. the host list or the module list to have in the alert more infos.

Ciao.
Giuseppe

Re: Alert custom condition

to4kawa — Wed, 27 Nov 2019 16:27:01 GMT

index="iway_idoc" TMSG_TYPE="SAP_PLANARRIV" STATUS=Error
|stats count by your_important_message_field

Hi, folks.
If you set it up as @jaime.ramirez says and write $result.your_inportant_message_field$ in the body, you'll get better.

Re: Alert custom condition

woodcock — Wed, 27 Nov 2019 18:30:27 GMT

Like this:

index="iway_idoc" AND TMSG_TYPE="SAP_PLANARRIV"
| stats count BY STATUS
| where match(STATUS, "Error") AND count > 0