topic Re: Alerts: Getting Multiple Values into Alert in Alerting

Alerts: Getting Multiple Values into Alert

vinodmadaan — Thu, 10 Sep 2015 15:45:26 GMT

Hi Guys,

I am not sure if this has been asked before (as I couldn't find anything on this issue).

I am working on a issue in which I have to create an alert for the thread count from 6 different servers, they come in as different log entries into splunk. So what I am looking for is a way to get these 6 values into the alert and trigger if any of these 6 crosses the threshold (one of the possible solution is creating 6 alerts and keeping track of each server separately, but I am looking for a way to get this done through one Alert only).

Is it possible?

Thanks in advance!

Re: Alerts: Getting Multiple Values into Alert

somesoni2 — Thu, 10 Sep 2015 16:24:18 GMT

Do the Threadcount from these 6 servers (assuming they are forwarders) go to central indexer(s)?

Re: Alerts: Getting Multiple Values into Alert

rechteklebe — Thu, 10 Sep 2015 16:41:40 GMT

Index=$yourindex host=host1 OR host=host2 OR host=host3 OR host=host4 OR host=host5 OR host=host6 $everythingelsetofindthethreaddata | stats max(Threads) as "maxthreads" by host | search "maxthreads"> $threshold

Re: Alerts: Getting Multiple Values into Alert

vinodmadaan — Fri, 11 Sep 2015 07:28:17 GMT

yes they go to a central indexer.

Re: Alerts: Getting Multiple Values into Alert

vinodmadaan — Mon, 28 Sep 2015 11:19:39 GMT

it worked as needed, thanks 🙂