topic Re: How to trigger this type of a alert? in Alerting

How to trigger this type of a alert?

tchintam — Tue, 15 May 2018 09:02:37 GMT

Hi,

I have these events from where I calculate response time for the particular ping. The events are generated randomly and not at any particular time. So, I want to create an alert in such a way that if the response time is greater than 10 sec for more than 30 mins, it should trigger an alert. How do I go about it?

Re: How to trigger this type of a alert?

mayurr98 — Tue, 15 May 2018 09:54:33 GMT

can you provide the search to calculate response time?
you can use timechart command to segregate the response time.

<base search with response time and time>| timechart span=30m sum(response_time) as response_time | where response_time>10

Assuming that response time is in seconds already otherwise you would need to convert to seconds intially.

Let me know if this helps!

Re: How to trigger this type of a alert?

tchintam — Tue, 15 May 2018 10:03:16 GMT

The response time is already in seconds. Could you please explain the timechart span=30m that you used?

Re: How to trigger this type of a alert?

mayurr98 — Tue, 15 May 2018 10:09:02 GMT

I think this doc would explain it better:
http://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/Timechart

timechart will make a bin of span of 30 minutes and in that 30 minutes, it will check for the response time greater than 10 specified in the where clause.

Re: How to trigger this type of a alert?

tchintam — Tue, 15 May 2018 10:21:49 GMT

Mayur - I don't think you understood my question. I have to trigger an alert iff the response time is greater than 10 sec even after 30 mins, i.e. for first 30 mins, no alert. 30 mins 1 sec(if still the response time is >10s), the alert has to be triggered.