topic Re: when no events or any field contains contains zero for past hour through an alert in Splunk Search

when no events or any field contains contains zero for past hour through an alert

kirrusk — Tue, 08 Feb 2022 07:53:04 GMT

Hi,

I'm trying to trigger an alert for the below scenarios (one alert).

scenario one: when there are no events, trigger alert.
Scenario two: When any of the fields contains (Zero) for the past hour.

DATE FIELD1 FIELD2 FIELD3
2-8-2022 45 56 67
2-8-2022 54 67 87
2-8-2022 0 56 0
2-8-2022 543 56 676

Trigger an alert if (no events) are coming for any particular field or a field contains (Zero) in the past hour.

For example : the above table needs to trigger an alert by giving a table as result.

Re: when no events or any field contains contains zero for past hour through an alert

gcusello — Tue, 08 Feb 2022 08:00:22 GMT

Hi @kirrusk,

you have to define a time range of calculation, e.g. every day and the run something like this:

index=your_index latest=-1h@h earliest=@h | bin _time span=1h | stats count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 BY _time | append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ] | stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time | where FIELD1=0 OR FIELD2=0 OR FIELD3=0

Ciao.

Giuseppe

Re: when no events or any field contains contains zero for past hour through an alert

kirrusk — Tue, 08 Feb 2022 09:47:44 GMT

@gcusello Thank you, it's working
it's my bad not tell about query what I'm using.
I'm trying to use tstats

So modified query like below

| tstats count WHERE index=your_index AND(TMPFIELD="FIELD1" OR TMPFIELD="FIELD2" OR TMPFIELD="FIELD3") GROUPBY index TMPFIELD _time latest=-1h@h earliest=@h | timechart count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 | append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ] | stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time | where FIELD1=0 OR FIELD2=0 OR FIELD3=0

But problem is, it's giving zero in the table if data is present in the field also

EXAMPLE,
FIELD1 FIELD2 FIELD3
0 0 0

But in reality, field3 has values
FIELD1 FIELD2 FIELD3
0 0 59

so it should through alert as well, because FIELD1 & FIELD2 are Zero.

Re: when no events or any field contains contains zero for past hour through an alert

gcusello — Tue, 08 Feb 2022 09:46:21 GMT

Hi @kirrusk,

tstats is always a good approach!

good for you, see next time, please accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: karma Points are appreciated 😉