topic Re: when splunk error count is more than a number in Alerting

when splunk error count is more than a number

rajs115 — Thu, 11 Nov 2021 19:43:26 GMT

Hi,

I have a log file in splunk which reports the errors when ever something failed. Now i need to run a splunk query if a same error show up in Splunk more than 3 times in last 1 hour. If it happens i need to send an alert.

Can someone suggest me the query with time in it?

Thanks.

Re: when splunk error count is more than a number

PickleRick — Thu, 11 Nov 2021 20:33:32 GMT

Your "specification" can be interpreted in many ways 🙂

Do you just want to search for some alert and find out if it's 3 or more events? Or maybe you can have several different kinds of alerts and want to know if any single one of them occurs more than 3 times.

Re: when splunk error count is more than a number

rajs115 — Thu, 11 Nov 2021 20:37:48 GMT

@PickleRick ,

"Build failed" is what i need to check in each event logs over the last 1 hour. If its repeated more than 3 times(from 3 events) in last 1 hour i need to send an alert. I hope you get my question now 🙂

Thanks.

Re: when splunk error count is more than a number

PickleRick — Fri, 12 Nov 2021 16:11:19 GMT

Just do your search for "Build Failed" and trigger the alert when number of results is greater than 2. Easy.

Re: when splunk error count is more than a number

rajs115 — Fri, 12 Nov 2021 16:29:55 GMT

sure @PickleRick . Thank you