topic Question on setting up the alerts in Splunk Search

Question on setting up the alerts

prettysunshinez — Tue, 26 Jan 2021 05:03:49 GMT

I have a search query that outputs the count of the event for all the host (i.e., | stats count by host)

Now if the count is greater than 5,(for say host 1 and host 2 together gives more than 5 counts),an alert has to be triggered..

Let me know how..

TIA

@Anonymous

richgalloway — Tue, 26 Jan 2021 13:29:25 GMT

| stats count by host | stats sum(count) as count | where count > 5

prettysunshinez — Thu, 28 Jan 2021 12:23:21 GMT

Thanks @richgalloway for the suggestion..

But what i would want is,to have host wise count in the alert mail..and the alert has to be triggered if the overall count is greater than 5

isoutamo — Thu, 28 Jan 2021 14:22:58 GMT

You could try this

| stats count by host | streamstats sum(count) as total_count | where total_count > 5

r. Ismo

richgalloway — Thu, 28 Jan 2021 14:28:50 GMT

Perhaps this will fill the need. Search for this:

| stats count by host | addcoltotals labelfield=host label=TOTAL count

then have the alert trigger using the Custom setting:

search (host=TOTAL AND count > 5)