topic Re: Alert help needed - Filtered events are still appearing in Alerting

Alert help needed - Filtered events are still appearing

606866581 — Fri, 31 Jul 2015 09:21:09 GMT

Hi,
I only want my alert to trigger if a particular field value has failed 2 or more times in the last 50 occurances. My current search is:

sourcetype=mySource ST_Script="myScript.py" ST_LogType="Step Log" | dedup 50 ST_Comment | search ST_Status=Fail | stats count AS FailuresInLast50 by ST_Comment | where FailuresInLast50 >= 2

From the statistics tab this search appears to do what I wanted because only fields with 2 or more failures are appearing:

However when I go to create my alert condition (FailuresInLast50 count >= 2) I get an error because it can't parse my alert condition. I assume I'm going about this in slightly the wrong way, so some guidance would be much appreciated.
Thanks

Re: Alert help needed - Filtered events are still appearing

yannK — Fri, 31 Jul 2015 19:27:26 GMT

You asked all valued that are 2 or higher, therefore having events with where FailuresInLast50=2 is expected.
Are you sure tat all your values are not 2 ?
Can you run the same search without the "where" condition then see if you have values >2

Re: Alert help needed - Filtered events are still appearing

woodcock — Sat, 01 Aug 2015 17:22:18 GMT

You are trying to do the same thresh-holding work twice: once in your search and once in your alert trigger. You need to pick one place or the other. So let's keep your search exactly as it is. In this case, you need your alert Trigger condition to be Number of Results is Greater than 0. If you think about it, you will see what I mean but if not, just trust me and configure it this way and it will work.

Re: Alert help needed - Filtered events are still appearing

the_wolverine — Sat, 01 Aug 2015 22:33:24 GMT

LOL. Sometimes that's how you have to explain it.

Re: Alert help needed - Filtered events are still appearing

606866581 — Mon, 03 Aug 2015 08:12:43 GMT

Thanks for your answer, I'll give it a go and report back!