topic Re: How to create alert for each new events in Alerting

How to create alert for each new events

Naa_Win — Fri, 26 Apr 2024 22:46:48 GMT

Hello Team,

I have a error data coming to index (we filtered to send only error logs to this index ), I wanted to create an alert when ever there is any new events coming to that index and don't want to send the duplicate alert.

index=error_idx sourcetype=error_srctyp

Re: How to create alert for each new events

PickleRick — Fri, 26 Apr 2024 21:36:19 GMT

It seems a bit like an overkill to use Splunk for this if all you send are errors. 😉

But anyway, you should just search for events with continuous scheduling and you're set (just take into account possible delay in indexing).

Re: How to create alert for each new events

gcusello — Fri, 26 Apr 2024 21:38:56 GMT

Hi @Naa_Win ,

you have to define the frequency of your alert and run a simple search scheduled on the above frequency, if e.g. you want to run your alert every 5 minutes, you should run a search like the following:

index=error_idx sourcetype=error_srctyp earliest=-5m@m latest=@m

if you have events the alert triggers.

choosing a defined period you are sure that the alert triggers only one time on events.

Ciao.

Giuseppe

Re: How to create alert for each new events

Naa_Win — Sun, 28 Apr 2024 17:42:47 GMT

@gcusello @PickleRick Thank you for the reply.

We are sending data from application console to splunk through syslog and they define to send only error logs from their console.

So If I schedule to run at 15 mins frequency and 15 time range. Will there be any chance of missing events to be triggered. Our intention to get alert when ever there is new event and shouldn't repeat the same event in the alert.

Re: How to create alert for each new events

PickleRick — Sun, 28 Apr 2024 20:10:13 GMT

There is always a chance of missing the event in some circumstances. For example if there is a huge lag due to some network outage or something similar and you get your events indexed with several hours delay you won't find them when you're searching for recent events.

But you can minimise the risk. The typical approach is to search every - let's say 15 minutes - over a "slightly delayed" window. For example - you search from 16 minutes ago to 1 minute ago. Or 17-2, depending on your typical ingestion latency.

Re: How to create alert for each new events

gcusello — Sat, 01 Jun 2024 04:50:27 GMT

Hi @Naa_Win ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉