topic query the number between a range in Splunk Search

query the number between a range

deepakaakula — Fri, 17 Jul 2020 13:45:42 GMT

Hi,

I have alerts when the number goes above certain % of the disk usage. So there are alerts at 70, 80, 90. It works fine. But when there is a 70% alert, I get alerted twice, because of 70% and also 60% usage.

Here is what the query looks like. I am trying to keep the alert segmented to query the number only between 60-69.99 and 70.00-79.99 and so on.

aws_account="cloud" "DSM: Current disk usage for account" (account_disk_quota > 70 )

Re: query the number between a range

richgalloway — Fri, 17 Jul 2020 15:33:20 GMT

I don't understand why you are getting alerts about 60 when the alert clearly looks for values greater than 70.

Try this method for looking for values within a range.

aws_account="cloud" "DSM: Current disk usage for account" (account_disk_quota > 70 AND account_disk_quota < 80 )

Re: query the number between a range

deepakaakula — Fri, 17 Jul 2020 16:59:29 GMT

Thanks Rich. I have 4 different alerts with same query for 60, 70, 80, 90%. I just mentioned one of it here.

So when 90% is triggered, I get alerted 4 times.

I tried the query you gave with and operation. It did not seems to work.

Re: query the number between a range

richgalloway — Fri, 17 Jul 2020 17:18:13 GMT

Please explain "it did not seems to work". Did it work or did it not? What results did you get? What did you expect to get?

Re: query the number between a range

deepakaakula — Fri, 17 Jul 2020 17:30:50 GMT

sorry, please ignore my last message. I was querying it for different profile, and I got 0 events back.

I checked with the correct profile, and it worked perfectly now.

Thank you.

Re: query the number between a range

deepakaakula — Fri, 31 Jul 2020 01:09:36 GMT

hi @richgalloway

I thought the alert seems to be working fine, but today the disk usage hit 70%, but the alert has triggered twice. once for the 70% as expected, and also the 60% one. These are the queries I have right now.

Do you recommend any modifications?

60% threshold query: "aws_account="cloud" "DSM: Current disk usage for account" (account_disk_quota > 60 AND account_disk_quota < 70 )"

70% query: "aws_account="cloud" "DSM: Current disk usage for account" (account_disk_quota > 70 AND account_disk_quota < 80 )"

Re: query the number between a range

richgalloway — Fri, 31 Jul 2020 13:16:21 GMT

This seems normal to me. On the way to 70% usage, the disk would reach 60% usage, would it not?

Re: query the number between a range

deepakaakula — Fri, 31 Jul 2020 13:21:38 GMT

Right, but the disk was at 60% from last 2 weeks, and yesterday evening it reached 70%.
So every time there is an increase in the 70% range, I get alerted twice from 60% and 70% monitors.

Re: query the number between a range

richgalloway — Fri, 31 Jul 2020 14:44:33 GMT

I think I understand, but I don't have a suggestion. Sorry.