https://community.splunk.com/t5/Alerting/How-to-send-alert-for-consecutive-field-values-failure/m-p/477122#M8456 <PRE><CODE>| makeresults | eval _raw="job job_name time job_result abc abc_job 14:20 Failure def def_job 15:30 Failure ghi ghi_job 12:22 Failure annc annc_job 14:20 Failure defff defff_job 15:30 Failure ghhhi ghhhi_job 12:22 Failure abc abc_job 14:20 Success def def_job 15:30 Failure ghi ghi_job 12:22 Failure annc annc_job 14:20 Failure defff defff_job 15:30 Failure ghhhi ghhhi_job 12:22 Failure" | multikv forceheader=1 | table job job_name time job_result | streamstats reset_on_change=t count(eval(job_result="Failure")) as fail_count by job_result | eventstats max(fail_count) as alert_count </CODE></PRE> <P>Hi, <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/121510">@manish_singh_77</a>7<BR /> this is sample code.</P> <PRE><CODE>your_search | table job job_name time job_result | streamstats reset_on_change=t count(eval(job_result="Failure")) as fail_count by job_result | eventstats max(fail_count) as alert_count </CODE></PRE> <P><CODE>alert_count &gt; 5</CODE>, fire alert.</P> Wed, 30 Sep 2020 03:33:15 GMT to4kawa 2020-09-30T03:33:15Z https://community.splunk.com/t5/Alerting/How-to-send-alert-for-consecutive-field-values-failure/m-p/477121#M8455 <P>Hi All,</P> <P>I have a table where we have job_result field, whenever job_result field has "failure" value for consecutive 5 times then we need to set up an alert.</P> <P>Example</P> <P>job job _name time job result<BR /> abc abc_job 14:20 Failure<BR /> def def_job 15:30 Failure<BR /> ghi ghi_job 12:22 Failure<BR /> annc annc_job 14:20 Failure<BR /> defff defff_job 15:30 Failure<BR /> ghhhi ghhhi_job 12:22 Failure</P> Wed, 30 Sep 2020 03:33:09 GMT https://community.splunk.com/t5/Alerting/How-to-send-alert-for-consecutive-field-values-failure/m-p/477121#M8455 manish_singh_77 2020-09-30T03:33:09Z https://community.splunk.com/t5/Alerting/How-to-send-alert-for-consecutive-field-values-failure/m-p/477122#M8456 <PRE><CODE>| makeresults | eval _raw="job job_name time job_result abc abc_job 14:20 Failure def def_job 15:30 Failure ghi ghi_job 12:22 Failure annc annc_job 14:20 Failure defff defff_job 15:30 Failure ghhhi ghhhi_job 12:22 Failure abc abc_job 14:20 Success def def_job 15:30 Failure ghi ghi_job 12:22 Failure annc annc_job 14:20 Failure defff defff_job 15:30 Failure ghhhi ghhhi_job 12:22 Failure" | multikv forceheader=1 | table job job_name time job_result | streamstats reset_on_change=t count(eval(job_result="Failure")) as fail_count by job_result | eventstats max(fail_count) as alert_count </CODE></PRE> <P>Hi, <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/121510">@manish_singh_77</a>7<BR /> this is sample code.</P> <PRE><CODE>your_search | table job job_name time job_result | streamstats reset_on_change=t count(eval(job_result="Failure")) as fail_count by job_result | eventstats max(fail_count) as alert_count </CODE></PRE> <P><CODE>alert_count &gt; 5</CODE>, fire alert.</P> Wed, 30 Sep 2020 03:33:15 GMT https://community.splunk.com/t5/Alerting/How-to-send-alert-for-consecutive-field-values-failure/m-p/477122#M8456 to4kawa 2020-09-30T03:33:15Z https://community.splunk.com/t5/Alerting/How-to-send-alert-for-consecutive-field-values-failure/m-p/477123#M8457 <P>Hi @to4kawa </P> <P>I want to send an alert if specific job is failing for 5 consecutive times.</P> Fri, 17 Jan 2020 11:30:28 GMT https://community.splunk.com/t5/Alerting/How-to-send-alert-for-consecutive-field-values-failure/m-p/477123#M8457 manish_singh_77 2020-01-17T11:30:28Z https://community.splunk.com/t5/Alerting/How-to-send-alert-for-consecutive-field-values-failure/m-p/477124#M8458 <PRE><CODE>your_search | table job job_name time job_result | streamstats reset_on_change=t count(eval(job="abc" AND job_result="Failure")) as fail_count by job_result | eventstats max(fail_count) as alert_count </CODE></PRE> <P>please add <EM>job</EM>.</P> Fri, 17 Jan 2020 14:16:16 GMT https://community.splunk.com/t5/Alerting/How-to-send-alert-for-consecutive-field-values-failure/m-p/477124#M8458 to4kawa 2020-01-17T14:16:16Z