Splunk Subsequent Alert

chintu_jain — Mon, 11 Jun 2018 20:44:15 GMT

Hi,

I am running an alert for every 15 mins and looking for a logic to stop subsequent splunk alerts if a field value remains the same during the next run of the alert. The next alert should trigger only if the field value changes

Appreciate if someone can help with the logic.

Re: Splunk Subsequent Alert

cpetterborg — Mon, 11 Jun 2018 22:37:52 GMT

You can do several things. If you only need to compare two time periods ad see if there is a difference, you can use multisearch. Something like this might work:

| multisearch 
    [ search <your-search-to-get-data> earliest=-30m@m latest=-15m@m
    | eval type=first] 
    [ search <your-search-to-get-data> earliest=-15m@m latest=-0m@m
    | eval type=next]
| stats values(<field-you-want-to-compare>) as val
| eval diff=if(mvindex(val,0)!=mvindex(val,1),1,0)

This can take any time periods that you want, for example, you can set it to the same time on the previous day to be compared with the value today, so it is general in nature. Just set the earliest and latest times appropriately. The stats command makes a multivalue field that can then be used with the eval. The mvindex function let's you grab the two values that you get and set the difference in the field diff. If the value of diff is 1, then they are different, and if 0, then the same. This is a very generalized way to handle doing this. There are many ways to make it more efficient or effective.

You don't really need the eval type="first" or eval type="last". It just makes it possible to see the values separately. Don't worry about getting hung up on what it does, because in this case it doesn't really do anything, but it could be useful in some circumstances.

topic Splunk Subsequent Alert in Alerting

Splunk Subsequent Alert

Re: Splunk Subsequent Alert