topic Re: Splunk single alert for multiple http status code in Alerting

How to create Splunk single alert for multiple http status code?

vinothkumark — Mon, 23 Jan 2023 20:09:18 GMT

I have a field which contains http status code. I want to create a single alert query with multiple conditions.

Example:
condition1) status code is 500 and greater than 10% alert should be triggered.
Condition 2) status code is 403 and greater than 20% alert should be triggered.
Condition 3) status code is 503 and greater than 20% alert should be triggered.

Also, Is it possible to have different time range for the above condition? like condition 1 and condition 2 should search for last 15 minutes, whereas condition 3 should search for last 30 mins.

How do I form the query?

Re: Splunk single alert for multiple http status code

gcusello — Mon, 23 Jan 2023 18:44:34 GMT

Hi @vinothkumark ,

the condition on status codes and percentages is easy:

<your_search> status_code IN("500","403","503") | stats count(eval(if(status_code="500",1,0))) AS 500_count count(eval(if(status_code="403",1,0))) AS 403_count count(eval(if(status_code="503",1,0))) AS 503_count count | where 500_count/count>=0.1 OR 403_count/count>=0.2 OR 503_count/count>=0.2

the time condition can be easily added running two alerts or using a more complicated main search:

<your_search> ((status_code IN ("500","403") earliest=-15m) OR (status_code="503" earliest=-30m)) | stats count(eval(if(status_code="500",1,0))) AS 500_count count(eval(if(status_code="403",1,0))) AS 403_count count(eval(if(status_code="503",1,0))) AS 503_count count | where 500_count/count>=0.1 OR 403_count/count>=0.2 OR 503_count/count>=0.2

Ciao.

Giuseppe

Re: Splunk single alert for multiple http status code

vinothkumark — Tue, 24 Jan 2023 13:22:07 GMT

It shows error in where command

Re: Splunk single alert for multiple http status code

gcusello — Tue, 24 Jan 2023 13:28:32 GMT

Hi @vinothkumark,

it should correctly run, please debug it using one by one the conditions.

Ciao.

Giuseppe