topic Re: custom alert condition for alert in Alerting

custom alert condition for alert

anoopambli — Mon, 28 Sep 2020 13:55:56 GMT

Can someone help me with this, i am pretty new to splunk and getting stuck with a custom alert condition. This is the search which i am using.

index=coreops sourcetype="sitescope_runmonitor" "ERROR - skipped #5" | top host by remoteHost | rename host AS SiS_Manager

gives me following result,

remoteHost SiS_Manager Count percent
eiman122vwin ei0760vwin 1 100.00000

I want to use trigger if custom conditions to match the value in count column and alert if any value is found higher thatn 5. I tried to use count>5 but that doesnt work. Any help would be really appreciated.

Anoop

Re: custom alert condition for alert

alacercogitatus — Fri, 17 May 2013 14:20:15 GMT

You could setup your search as such:

index=coreops sourcetype="sitescope_runmonitor" "ERROR - skipped #5" | top host by remoteHost | rename host AS SiS_Manager | where count > 4

and then in your alert, set the condition to "if number events > 0"

Re: custom alert condition for alert

anoopambli — Fri, 17 May 2013 16:34:23 GMT

Not sure if iam trying anything wrong in the custom condition, but getting this error message,

Cannot parse alert condition. Error in 'SearchParser': Missing a search command before '"'.

I am getting this error on Create alert, trigger if custom condition.

Re: custom alert condition for alert

alacercogitatus — Fri, 17 May 2013 19:12:47 GMT

You want to use the "if number events" condition, not custom condition, and then put a 0 in the box.

Re: custom alert condition for alert

eroncampello — Tue, 23 Jan 2024 15:02:46 GMT

I was facing the same issue, I used the following condition and is working fine

search result_of_search > 10