https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467666#M131632 <P>example in this case would be trigger an alert when avg(time) for A &gt; 2 and count &gt;3 then evaluate avg(time) for B &gt;5 and count &gt; 10. If all the conditions meets then only trigger an alert.</P> Tue, 29 Oct 2019 20:43:30 GMT abhishekbhasin 2019-10-29T20:43:30Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467662#M131628 <P>Trying to setup up an alert with multiple fields extracted through Field.</P> <P>For example A,B, C etc and each having a different threshold for avg(time) and count. </P> <P>Below is an example:</P> <P><CODE>index=XXXX sourcetype="XXX" | where Field in("A") | stats count avg(time) as A | where A&gt;2 and count&gt;3| where Field in("B") |stats count avg(time) as B | where B&gt;5 and count&gt;10</CODE></P> Tue, 29 Oct 2019 18:12:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467662#M131628 abhishekbhasin 2019-10-29T18:12:03Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467663#M131629 <P>Hi there - </P> <P>Currently we don't support multiple fields in separate the same condition (e.g. you can do A&gt;0 and A&lt;10 but not A&gt;0 and B&gt;0).</P> <P>The work around is to create a new single column that represents the underlying logic of the column combination e.g.</P> <P>From original <BR /> index=XXXX sourcetype="XXX" <BR /> | where Field in("A")<BR /> | stats count avg(time) as A <BR /> | where A&gt;2 and count&gt;3 --condition1<BR /> | where Field in("B") <BR /> |stats count avg(time) as B <BR /> | where B&gt;5 and count&gt;10 --condition2</P> <P>Change base search to something along the lines of:<BR /> index=XXXX sourcetype="XXX"<BR /> | eval a_or_b=case(Field in("A"), "A", Field in("B"), "B")<BR /> | stats count() as myCount, avg(time) as avg_time by a_or_b<BR /> | eval alert_a=case(a_or_b="A" AND avg_time&gt;2 AND count&gt;3, 1)<BR /> | eval alert_b=case(a_or_b="B" AND avg_time&gt;5 AND count&gt;10, 1)</P> <P>In the UI....<BR /> Condition 1: alert_a = 1 --&gt; actions<BR /> Condition 2: alert_b = 1--&gt; actions</P> <P>Also please feel free to email <A href="mailto:scs-alerts@splunk.com" target="_blank">scs-alerts@splunk.com</A> if you run into any additional trouble!</P> Wed, 30 Sep 2020 02:46:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467663#M131629 mluna_splunk 2020-09-30T02:46:04Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467664#M131630 <P>Can you write out some example data? I'm having a hard time coming up with a catch all answer for a few different cases I can think of that you might be talking about, and don't want to lead you down the wrong path!</P> Tue, 29 Oct 2019 20:37:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467664#M131630 aberkow 2019-10-29T20:37:13Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467665#M131631 <P>Have an answer pending post...</P> Tue, 29 Oct 2019 20:38:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467665#M131631 mluna_splunk 2019-10-29T20:38:01Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467666#M131632 <P>example in this case would be trigger an alert when avg(time) for A &gt; 2 and count &gt;3 then evaluate avg(time) for B &gt;5 and count &gt; 10. If all the conditions meets then only trigger an alert.</P> Tue, 29 Oct 2019 20:43:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467666#M131632 abhishekbhasin 2019-10-29T20:43:30Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467667#M131633 <P>You cannot do it in the alert dialog so do it just like you are in SPL at the end and set your alert trigger to <CODE>number of results</CODE> and <CODE>is greater than zero</CODE>. This is more clear to the analysts anyway.</P> Tue, 29 Oct 2019 20:50:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467667#M131633 woodcock 2019-10-29T20:50:03Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467668#M131634 <P>Splunk Investigate Alerts don't support Number of Results &gt; foo</P> Tue, 29 Oct 2019 20:51:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467668#M131634 mluna_splunk 2019-10-29T20:51:39Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467669#M131635 <P>Able to get the data with above mentioned query but having trouble building alert since it's a custom alert.</P> <P>Could you please send syntax for this<BR /> Condition 1: alert_a = 1 --&gt; actions<BR /> Condition 2: alert_b = 1--&gt; actions</P> Wed, 30 Sep 2020 02:44:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467669#M131635 abhishekbhasin 2020-09-30T02:44:02Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467670#M131636 <P>Able to get the data with above mentioned query but having trouble building alert since it's a custom alert.</P> <P>Could you please send syntax for this<BR /> Condition 1: alert_a = 1 --&gt; actions<BR /> Condition 2: alert_b = 1--&gt; actions</P> Wed, 30 Sep 2020 02:48:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467670#M131636 abhishekbhasin 2020-09-30T02:48:14Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467671#M131637 <P>Hi there - you don't need syntax for that. You simply designate the numeric field in the Splunk Investigate triggers &amp; alerts UI and whether &lt;&gt;= a particular value. </P> <P>See <A href="https://docs.splunk.com/Documentation/SplunkInvestigate/Current/Use/Trigger">https://docs.splunk.com/Documentation/SplunkInvestigate/Current/Use/Trigger</A></P> Thu, 31 Oct 2019 18:16:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467671#M131637 mluna_splunk 2019-10-31T18:16:19Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467672#M131638 <P>Happy to help further w your specific case if you email <A href="mailto:scs-alerts@splunk.com">scs-alerts@splunk.com</A></P> Thu, 31 Oct 2019 18:16:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467672#M131638 mluna_splunk 2019-10-31T18:16:41Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467673#M131639 <P>WHAT???? Are you <EM>sure</EM>? That is <EM>CRAZY</EM>!</P> Thu, 31 Oct 2019 21:23:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467673#M131639 woodcock 2019-10-31T21:23:56Z https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467674#M131640 <P>Yep. You'd append a | stats count() to your base search to approx that behavior. For now. Welcome any feedback -- <A href="mailto:scs-alerts@splunk.com">scs-alerts@splunk.com</A> and encourage you to sign up for the Investigate trial!</P> Fri, 01 Nov 2019 16:24:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-set-up-alerts-with-multiple-fields-with-different/m-p/467674#M131640 mluna_splunk 2019-11-01T16:24:31Z