Conditional Alerting

mookiie2005 — Mon, 28 Sep 2020 17:03:58 GMT

I am trying to indicate that a problem has been resolved or is no longer an issue. What I want to do is have an alert that searches to see if a specific alert has triggered in the last 10 minutes. If it HAS then I want to do a secondary search to look for all alerts that begin with the prefix "PLCY_SVCS_bindqtesvc" I want the alert to fire an e-mail if 1 or less alerts with the prefix PLCY_SVCS_bindqtesvc" have been fired. I have been using the below search, but I cannot get it to function in the manner I need. Please help:

index=_audit action=alert_fired ss_app=* ss_name=* triggered_alerts=1 [search index=_audit action=alert_fired ss_app=* ss_name=PLCY_SVCS_bindqtesvc_RED_status_Sean_TEST triggered_alerts=1 | stats count AS count ss_name app_log | where count > 0 | table app_log] earliest=-10m@m | stats count | where count < 2

Re: Conditional Alerting

somesoni2 — Mon, 28 Sep 2020 17:04:03 GMT

Try this

index=_audit action=alert_fired ss_app=* ss_name=PLCY_SVCS_bindqtesvc_RED_status_Sean_TEST triggered_alerts=1 | stats count | where count > 0 
| map maxsearches=1 search="search index=_audit action=alert_fired ss_app=* ss_name=PLCY_SVCS_bindqtesvc* triggered_alerts=1 | stats count | where count <2"

Here, first the count of events with ss_name=PLCY_SVCS_bindqtesvc_RED_status_Sean_TEST is calculated. If count > 0 then next search will get executed to get the count of alerts for ss_name with prefix PLCY_SVCS_bindqtesvc. You can set alert to get trigged if there are any rows retured by the search (it will return one rows with column as count if all conditions are true)

topic Re: Conditional Alerting in Alerting

Conditional Alerting

Re: Conditional Alerting