topic Re: Alert - Multiple Condition Confusion in Alerting

Alert - Multiple Condition Confusion

chrisboy68 — Thu, 10 Mar 2016 14:44:28 GMT

Hi, this should be simple, but its making my head hurt.

(index=myindex OR index=_internal) (myfield=*  OR source=*dbx2*) |   search myfield = *  NOT  "Caught exception Splunkd daemon is not responding"

At times, I have ran into issues with the splunkd not responding for DB2. I have the above search in an Alert. It fires when there are 0 rows within 10 minutes (there should always be at least one row in 10 min), but I don't want it to fire if it finds "Caught exception Splunkd daemon is not responding".

I think I'm going about this wrong. How can I make a conditional alert that only fires if 0 rows are returned in the search and does not contain "Caught exception Splunkd daemon is not responding"?

Thanks

Chris

Re: Alert - Multiple Condition Confusion

richgalloway — Thu, 10 Mar 2016 15:41:31 GMT

Try this:

(index=myindex OR index=_internal) (myfield=*  OR source=*dbx2*) NOT  "Caught exception Splunkd daemon is not responding"

Re: Alert - Multiple Condition Confusion

chrisboy68 — Thu, 10 Mar 2016 18:47:30 GMT

Ok, as expected, I over thought this one. Since the Alert first when the return result is NOT 0, the doing this:
search myfield = * OR "Caught exception Splunkd daemon is not responding"
Works for my Alert (it wont fire if a Splunkd exception is returned).

Sorry,

Chris