topic Re: How to create a unique value on 0 event searches? in Alerting

How to create a unique value on 0 event searches?

vishalduttauk — Fri, 14 Oct 2022 17:19:40 GMT

I have a search which triggers an alert if an event hasn't be received by 6.20 am. That alert works fine but it needs to send data into another system. That system needs a unique id within it's Key field.

key=$result._time$ won't work as the event doesn't exist.

Is there a way to add a unique value into that key field on an event that doesn't exist?

The search is:

sourcetype=Batch OR sourcetype=ManualBatch "Step 'CleanupOldRunlogs' finished with status SUCCESS"

Re: How to create a unique value on 0 event searches

richgalloway — Fri, 14 Oct 2022 13:52:14 GMT

This is a job for appendpipe. The appendpipe command runs commands against the current results and, among other things, lets you give values to fields when there are no results.

sourcetype=Batch OR sourcetype=ManualBatch "Step 'CleanupOldRunlogs' finished with status SUCCESS" | appendpipe [ stats count | eval key="foo" | where count=0 | fields - count ]

Here, appendpipe checks how many results there are and sets a value for the key field. That value is shown only if count is zero. Finally, the count field is discarded.

Re: How to create a unique value on 0 event searches

vishalduttauk — Fri, 14 Oct 2022 14:15:03 GMT

Thanks @richgalloway

Is there a way to make the value for key unique. i.e. the alert could be triggered today and tomorrow but i want each value to be different

Re: How to create a unique value on 0 event searches

johnhuang — Fri, 14 Oct 2022 15:07:16 GMT

You can set the key to the current timestamp.

| eval key=strftime(now(), "%Y-%m-%d %H:%M:%S")

Re: How to create a unique value on 0 event searches

richgalloway — Fri, 14 Oct 2022 15:09:54 GMT

You could set key to the current time.

sourcetype=Batch OR sourcetype=ManualBatch "Step 'CleanupOldRunlogs' finished with status SUCCESS" | appendpipe [ stats count | eval key=now() | where count=0 | fields - count ]

Re: How to create a unique value on 0 event searches

PickleRick — Fri, 14 Oct 2022 16:41:36 GMT

I'd say whenever you can, store the time as a numeric timestamp, not as string. It's easier to manipulate, and you don't have to waste resources to parse it.

Re: How to create a unique value on 0 event searches

johnhuang — Fri, 14 Oct 2022 19:31:51 GMT

Epoch time works but it depends if you want it to be human readable or not on the 3rd party system.

Re: How to create a unique value on 0 event searches

PickleRick — Fri, 14 Oct 2022 19:48:15 GMT

Sure. In this case rendering the value to text seems to be a bit of an overkill. And it's always cheaper to render a timestamp to a string than to parse a string to a timestamp.

Re: How to create a unique value on 0 event searches?

vishalduttauk — Tue, 18 Oct 2022 08:10:53 GMT

I managed to find a solution which is to use $job.latestTime$ instead. I have applied this to all our alerts now.

This is where I got the idea from: https://community.splunk.com/t5/Dashboards-Visualizations/Setting-job-earliestTime-and-job-latestTime-tokens-for-the-date/m-p/345199