topic Re: set up alert in Alerting

set up alert

thinktanku — Wed, 24 Jun 2020 20:31:59 GMT

Hello Team ,

i need to set up alert when to condition meets i should get alert.
1st condition (string) - BEA-000337
2nd condition Started time is greater than 6000 ms

could you please help

Re: set up alert

richgalloway — Wed, 24 Jun 2020 20:36:39 GMT

Please provide some sample events and say what fields are extracted from them.

Re: set up alert

thinktanku — Wed, 24 Jun 2020 20:58:35 GMT

here is sample event :

########################################################################

<Error> <WebLogicServer> <BEA-000337> <[STUCK] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)' has been busy for "633" seconds working on the request Version: 0, Scheduled=false, Started=true, Started time: 11600000 ms

##########################################################################

when we get stuck thread . . BEA-000337 error code will always be there but tricky part i just need to get alert only when Started time: greater than 1000000 ms

Re: set up alert

richgalloway — Thu, 25 Jun 2020 12:40:03 GMT

You didn't include the fields that are extracted from this event so we may be doing this the hard way.

index=foo "BEA-000337" | rex "Started time: (?<startedTime>\d+)" | where startedTime > 1000000

Save this search as an alert and have the alert trigger when the number of results is not zero.

Re: set up alert

thinktanku — Thu, 25 Jun 2020 12:51:55 GMT

thank you so much @ richgalloway

Re: set up alert

richgalloway — Thu, 25 Jun 2020 13:28:06 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.