https://community.splunk.com/t5/Alerting/Looking-for-solution-of-one-alert-calling-script-to-execute/m-p/259167#M4809 <P>subsearch is the solution for me. I had never really used it before. That is exactly what I wanted. Thanks!</P> Fri, 20 May 2016 05:16:04 GMT burwell 2016-05-20T05:16:04Z https://community.splunk.com/t5/Alerting/Looking-for-solution-of-one-alert-calling-script-to-execute/m-p/259165#M4807 <P>We want to do a search every minute on some logs. We want to identify those hosts whose events have http_code=5xx more than one percent of the time. And we want to see the actual events.</P> <P>What I envisioned was one alert that would count the total events, count the 5xx events and when 5xx/total &gt; 1% would alert and call a script that would perform a second search on the very same time event and show us the hosts and events that are involved.</P> <P>We tried various things including evenstats, but it is too slow trying to do this in one search every minute. The search took too long.</P> <P>I'm looking for a script called by search1 where I can call a named saved search2 with earliest/latest that I get from search1 and then have it alert.</P> <P>Or maybe this is too complicated and there is a simpler way to go about this. Thanks!</P> Fri, 20 May 2016 00:15:29 GMT https://community.splunk.com/t5/Alerting/Looking-for-solution-of-one-alert-calling-script-to-execute/m-p/259165#M4807 burwell 2016-05-20T00:15:29Z https://community.splunk.com/t5/Alerting/Looking-for-solution-of-one-alert-calling-script-to-execute/m-p/259166#M4808 <P>Do you need to see all the events containing a 5xx error or would a sample do? if so, experiment with something like</P> <P>| stats latest(_raw) as sample_event</P> <P>If that's no good, I might suggest using a <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchTutorial/Useasubsearch" target="_blank">subsearch</A> with <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Append" target="_blank">append</A> or <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Appendcols" target="_blank">appendcols</A></P> Tue, 29 Sep 2020 09:44:47 GMT https://community.splunk.com/t5/Alerting/Looking-for-solution-of-one-alert-calling-script-to-execute/m-p/259166#M4808 dolivasoh 2020-09-29T09:44:47Z https://community.splunk.com/t5/Alerting/Looking-for-solution-of-one-alert-calling-script-to-execute/m-p/259167#M4809 <P>subsearch is the solution for me. I had never really used it before. That is exactly what I wanted. Thanks!</P> Fri, 20 May 2016 05:16:04 GMT https://community.splunk.com/t5/Alerting/Looking-for-solution-of-one-alert-calling-script-to-execute/m-p/259167#M4809 burwell 2016-05-20T05:16:04Z https://community.splunk.com/t5/Alerting/Looking-for-solution-of-one-alert-calling-script-to-execute/m-p/259168#M4810 <P>If you answer the question I can then accept the answer...</P> Fri, 20 May 2016 05:21:44 GMT https://community.splunk.com/t5/Alerting/Looking-for-solution-of-one-alert-calling-script-to-execute/m-p/259168#M4810 burwell 2016-05-20T05:21:44Z