topic Re: Help in setting alert in Alerting

Help in setting alert

vrmandadi — Wed, 13 Apr 2016 22:53:49 GMT

Hello,

I am setting an alert based on the count i.e if the count is greater than 50 then we need to generate an alert.

I wrote the query and saved as alert

alert type=Real time
Trigger Condition=Custom
Custom Condition= search count>50
time: in 5 mins
and then selected the e-mail as triggered condition

in Throttle what should I give such that the alert when generated in 5 minutes should set the time back to zero before generating another alert

Re: Help in setting alert

ChrisG — Wed, 13 Apr 2016 23:22:37 GMT

If your search is scheduled to run every five minutes (is it, actually?), then set the throttling to suppress the alert to something greater than five minutes.

Re: Help in setting alert

vrmandadi — Thu, 14 Apr 2016 17:05:24 GMT

its not every 5 minutes,it will alert if the count is greater than 50 in a 5 mins window

Re: Help in setting alert

ChrisG — Thu, 14 Apr 2016 17:11:05 GMT

So what is the schedule you have set for the search itself?

Re: Help in setting alert

vrmandadi — Thu, 14 Apr 2016 21:26:42 GMT

all time for search,the alert is customized

search count>50

is the syntax correct for the alert or should it be in double quotes

Re: Help in setting alert

frobinson_splun — Thu, 14 Apr 2016 22:24:52 GMT

Hi @vrmandadi,
I think it might be helpful to reconsider the alerting behavior you would like to have. When you say, "set the time back to zero" in your original question, it makes me think that you might want a scheduled alert that runs a search every five minutes to check for more than 50 events. If there are more than 50 results for that search, you get an email notification. Does that sound more like the outcome you are trying to set up? Let me know either way and I can suggest some resources.

As a start, this comparison chart might help.
http://docs.splunk.com/Documentation/Splunk/6.4.0/Alert/AlertTypesOverview