topic Re: How do you create an alert in Splunk that checks a file for one code and then must see another code within 4 hours or a ticket is cut? in Alerting

How do you create an alert in Splunk that checks a file for one code and then must see another code within 4 hours or a ticket is cut?

nls7010 — Fri, 11 Jan 2019 13:51:26 GMT

I need to create an alert that checks for a particular code number, and when it comes in, then if another code doesn't come in within 4 hours, a ticket is cut. I know how to check for the first code, but I'm not certain how to do the span and search for the 2nd code number.

Re: How do you create an alert in Splunk that checks a file for one code and then must see another code within 4 hours or a ticket is cut?

richgalloway — Fri, 11 Jan 2019 15:32:46 GMT

This may get you started.

<your search for the code number> earliest=-4h | stats count | where count<2

Re: How do you create an alert in Splunk that checks a file for one code and then must see another code within 4 hours or a ticket is cut?

nls7010 — Fri, 11 Jan 2019 15:52:50 GMT

So I'm assuming that after that part of the code I would put in the if count not zero, send alert?

Re: How do you create an alert in Splunk that checks a file for one code and then must see another code within 4 hours or a ticket is cut?

richgalloway — Sun, 13 Jan 2019 02:59:07 GMT

Not quite. Leave the query as it is and set your alert to trigger if the number of results is not zero.

Re: How do you create an alert in Splunk that checks a file for one code and then must see another code within 4 hours or a ticket is cut?

woodcock — Sun, 13 Jan 2019 22:43:05 GMT

Assuming that you have a field like account that you need to group by, run something like this every hour with the timepicker set to "Last 5 Hours" (set your alert trigger to when = number of results and is greater than 0)

| makeresults 
| eval account="foo bar bat"
| makemv account
| mvexpand account
| eval code=case(account=="foo", "start middle middle stop", account=="bar", "stop", true(), "start")
| makemv code
| mvexpand code
| stats max(_time) AS _time first(code) AS code BY account
| where code=="start" AND _time <= relative_time(now(), "-240min")

Re: How do you create an alert in Splunk that checks a file for one code and then must see another code within 4 hours or a ticket is cut?

nls7010 — Mon, 14 Jan 2019 11:53:35 GMT

I will give this a try.