topic Re: How to create a single alert for all HTTP error codes in events? in Alerting

How to create a single alert for all HTTP error codes in events?

allurirohan — Fri, 30 Oct 2015 14:16:09 GMT

Hi,

I would like to create a single alert for all HTTP error codes in events.
Ex: I would like to create an alert for 400,404,500 etc error codes if the count reaches 25 in 5 mins period for 2 error codes and if the count reaches 250 for other error code. Do I need to create an alert for each error code, or is there a way we can include everything in single alert?

Would really appreciate if anyone can help.

Re: How to create a single alert for all HTTP error codes in events?

woodcock — Fri, 30 Oct 2015 17:29:12 GMT

Like this (for a single alert/search):

... (errorCode=400 OR errorCode=404 OR errorCode=500) | bucket _time span=5 | stats count by errorCode _time | where (count<25 AND (errorCode=400 OR errorCode=404)) OR (count<250)

Re: How to create a single alert for all HTTP error codes in events?

allurirohan — Fri, 30 Oct 2015 18:06:53 GMT

Thank you for the quick response.
so , what trigger condition we need to select while creating the alert ?

Re: How to create a single alert for all HTTP error codes in events?

woodcock — Fri, 30 Oct 2015 18:10:37 GMT

Where Number of events and is greater than 0.

Re: How to create a single alert for all HTTP error codes in events?

allurirohan — Fri, 30 Oct 2015 18:27:08 GMT

Ok.One more question is , Is there a way to include the message in the alert description we which error code has exceeded the threshold?
Ex: we have the alert name as "Httperror alert" - but its just sending an alert with number of events (31).
So , we are not sure which error code exceeded,as we have 2 error codes has same threshold.

Re: How to create a single alert for all HTTP error codes in events?

woodcock — Fri, 30 Oct 2015 19:14:22 GMT

I am not sure what you mean here but perhaps this document will help:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Report/Schedulereports#Use_tokens_in_scheduled_report_email_subjects_and_bodies

Re: How to create a single alert for all HTTP error codes in events?

Richfez — Sat, 31 Oct 2015 02:36:49 GMT

In your "Save as Alert" dialog, in the "Send email" section, there are some options under "Include." Click the "Inline" option (4th one in that section) and leave the little drop-down next to it set to "table".

That will create a little table of the results of the search that triggered the alert, and include it in the email it sends, so you can see the data itself.