topic Re: Alert with 3 different threshold for 3 different event in on alert in Alerting

Alert with 3 different threshold for 3 different event in on alert

cbiraris — Fri, 26 Apr 2024 15:58:31 GMT

Hi team,

I need help to create a query with with 3 different threshold for 3 different event in single splunk alert.

for example :

index= abc
sourcetype=xyz

"warning" OR "Error" OR Critical

If any of these ("warning" OR "Error" OR Critical) occurred 5 times in events in last 15 minutes alert should be triggered .

Re: Alert with 3 different threshold for 3 different event in on alert

ITWhisperer — Fri, 26 Apr 2024 16:02:15 GMT

Please clarify your requirement - do you want the alert to trigger if any of the values occurs 5 times e.g. 2 warnings, 2 errors and 1 critical, or only if any of them individually occur 5 times e.g. 5 warnings or 5 errors or 5 criticals?

Re: Alert with 3 different threshold for 3 different event in on alert

cbiraris — Fri, 26 Apr 2024 16:16:36 GMT

Yes, only if any of them individually occur 5 times e.g. 5 warnings or 5 errors or 5 criticals

Re: Alert with 3 different threshold for 3 different event in on alert

cbiraris — Fri, 26 Apr 2024 16:17:03 GMT

Yes, only if any of them individually occur 5 times e.g. 5 warnings or 5 errors or 5 criticals

Re: Alert with 3 different threshold for 3 different event in on alert

gcusello — Fri, 26 Apr 2024 16:18:56 GMT

Hi @cbiraris ,

I suppose that these three values are in a field (e.g. type), so you can run a search like the folowing:

index= abc sourcetype=xyz type IN ("warning", "Error", Critical) | stats values(eval(type="warning")) AS warning_count values(eval(type="Error")) AS Error_count values(eval(type="Critical")) AS Critical_count | where warning_count>5 OR Error_count>5 OR Critical_count>5

you can aso setup a different threshold for each type of message.

If you don't have the three values in a fied, you have to use a similar search:

index= abc sourcetype=xyz ("warning" OR "Error" OR Critical) | stats values(eval(searchmatch("warning"))) AS warning_count values(eval(searchmatch("Error"))) AS Error_count values(eval(searchmatch("Critical"))) AS Critical_count | where warning_count>5 OR Error_count>5 OR Critical_count>5

Ciao.

Giuseppe

Re: Alert with 3 different threshold for 3 different event in on alert

cbiraris — Fri, 26 Apr 2024 16:25:56 GMT

Thank you this one working for me 🙂