topic Re: how to edit my search in Splunk Search

how to edit my search

sonila — Tue, 29 Sep 2020 14:54:17 GMT

earliest=-48h@h latest=-24h@h index="my-live-srv" sourcetype="Perfmon:sqlserver:sql_errors" counter="Errors/sec"| where instance="User Errors" | stats avg(Value) as PrevErrors | appendcols [ search earliest="-24h@h" latest="@h" index="my-live-srv" sourcetype="Perfmon:sqlserver:sql_errors" counter="Errors/sec" instance="User Errors" | stats avg(Value) as CurrErrors ]| eval PrevErrors=if(isnull(PrevErrors), 0, PrevErrors) | eval CurrErrors=if(isnull(CurrErrors), 0, CurrErrors) | eval CurrErrors=round(CurrErrors,3) |eval PrevErrors=round(PrevErrors,3) |eval CurrErrors=(CurrErrors + " Errors/sec") | eval PrevErrors=(PrevErrors + " Errors/sec") | appendcols [search earliest="-48h" latest="@h" index="my-live-srv" sourcetype="sql-trace" |where Date!="*$" | eval time_marker = if (_time < relative_time(now(), "-24h"), "yesterday", "today")| eval _time = if (time_marker=="yesterday", _time + 24*60*60, _time) ]| streamstats current=f window=1 global=f last(PrevErrors) as PrevErrors | streamstats current=f window=1 global=f last(CurrErrors) as CurrErrors|table CurrErrors,PrevErrors,time_marker,Date,Time, ID, HostName, ClientProcessID, ApplicationName, LoginName, SPID, Severity, EventClass, State, Error, DatabaseName, EventSequence

I want to save this as an alert but I want the alert to trigger only when CurrErrors >1. How can I do this ? I have tried with where condition but I dont have the expected result

Re: how to edit my search

somesoni2 — Wed, 12 Jul 2017 19:47:49 GMT

How about you add | where CurrErrors>1 in your search (at the end) itself and set the alert condition to where number of results is greater than 0?

Re: how to edit my search

sonila — Wed, 12 Jul 2017 19:50:58 GMT

nope that doesn't work. I have tried

Re: how to edit my search

somesoni2 — Wed, 12 Jul 2017 19:55:31 GMT

Got the issue. You're adding string text to CurrErrors making it a string and your where clause fails. Try adding this to your original search

...| where tonumber(replace(CurrErrors,"^(\d+)\s.+","\1"))>1

Re: how to edit my search

sonila — Wed, 12 Jul 2017 19:59:30 GMT

I tried now but no result again

Re: how to edit my search

sonila — Wed, 12 Jul 2017 20:06:40 GMT

| where CurrErrors < "1"
I needed to enter this in the end of the search
I found the solution, thank you for the help that CurrErrors was a string. This helped me a lot

Re: how to edit my search

woodcock — Wed, 12 Jul 2017 20:42:33 GMT

Be sure to click Accept to close the question.

Re: how to edit my search

sonila — Wed, 12 Jul 2017 20:45:26 GMT

cant accept, the answer is as a comment

Re: how to edit my search

woodcock — Wed, 12 Jul 2017 21:10:23 GMT

Now you can Accept!