topic Re: Trigger alert only if the result contain more than one host in Alerting

Trigger alert only if the result contain more than one host

sjcoluccio67 — Tue, 20 Aug 2019 16:01:03 GMT

Hey Everyone,

I have an alert set up that triggers when any host has more than 100 events in 5 minutes. Here is the exact search:

index=msexchange recipient_status="451 4.3.2 *" | stats count by host | where count > 100

the results of this search only shows a host if its event count is > 100 and it shows the exact count for each host. I want to alter this alert to show the same results, but only trigger if there is more than one host. Is there a way to do this? I have tried embedding a stats command inside of another stats command but I have had no luck.

Re: Trigger alert only if the result contain more than one host

sheamus69 — Tue, 20 Aug 2019 16:15:44 GMT

Have you tried something like:

index=msexchange recipient_status="451 4.3.2 *" | stats dc(host) as host_count by host | where host_count > 1

You could also do some sort of combo like:

index=msexchange recipient_status="451 4.3.2 *" | stats count dc(host) as host_count by host | where ( host_count > 1 AND count > 100 )

Note: edited to fix a bug

Re: Trigger alert only if the result contain more than one host

lmonteith — Tue, 20 Aug 2019 16:15:54 GMT

When you save the search as an alert under trigger conditions you can select number of hosts for the "Trigger alert when" field and set it to is greater than 1.

Re: Trigger alert only if the result contain more than one host

sheamus69 — Tue, 20 Aug 2019 16:20:31 GMT

Have you tried something like:

 index=msexchange recipient_status="451 4.3.2 *" | stats dc(host) as host_count by host | where host_count > 1

You could also do some sort of combo like:

 index=msexchange recipient_status="451 4.3.2 *" | stats count dc(host) as host_count by host | where ( host_count > 1 AND count > 100 )

Re: Trigger alert only if the result contain more than one host

Vijeta — Tue, 20 Aug 2019 16:26:37 GMT

@sjcoluccio67 You can keep your query as it is , and in the alert configuration -> Edit Alert -> Trigger Conditions->Trigger Alert when Number of Results >1

Re: Trigger alert only if the result contain more than one host

memarshall63 — Tue, 20 Aug 2019 16:38:57 GMT

Does this work for you?

index=msexchange recipient_status="451 4.3.2 *"  | stats count by host | where count > 100
| eventstats dc(host) as Hostcount 
| where Hostcount > 1
| fields - Hostcount

This should display all hosts and their counts if the total number of hosts > 1. If the total number of hosts is < 2 -- then nothing displays.

Re: Trigger alert only if the result contain more than one host

sjcoluccio67 — Tue, 20 Aug 2019 17:14:15 GMT

I have tried this, but host_count will never be greater than one because it counts each host individually. Here is what the results look like:

host | count | host_count
| |

xxx01 | 107 | 1
xxx02 | 36 | 1
xxx07 | 57 | 1

Re: Trigger alert only if the result contain more than one host

sjcoluccio67 — Tue, 20 Aug 2019 17:14:57 GMT

well, my formatting got messed up there^. I tried to make a table.