topic How to create alarms when count = 0? in Splunk Search

How to create alarms when count = 0?

ashidhingra — Wed, 22 Jun 2022 18:29:09 GMT

How can i create an alarm when a location goes down?

index=internal sourcetype=abc
| timechart span=5m count(linecount) AS Count by loc useother=f usenull=f
| sort by _time desc
| table _time loc | where loc< 10

2022-06-22 02:15:00	0	102	949	941	967	969	45	33
2022-06-22 02:14:00	0	143	1167	1139	1146	1195	49	75
2022-06-22 02:13:00	0	134	874	827	891	876	29	46
2022-06-22 02:12:00	1	130	770	789	773	736	59	60

Re: alarms when count = 0

ITWhisperer — Wed, 22 Jun 2022 06:28:40 GMT

After timechart, loc doesn't exist as a field (you have a field for each value of loc)

index=internal sourcetype=abc | timechart span=5m count(linecount) AS Count by loc useother=f usenull=f | sort -_time | untable _time loc Count | where Count < 10

The issue with this is that, as it stands, the values of loc will only be those found in the initial search, that is, if locA has been down for the entire period covered by the search, you still won't pick it up this way.

However, if it is down for one of the 5 minute periods, then you will be able to detect it

Re: alarms when count = 0

gcusello — Wed, 22 Jun 2022 06:33:07 GMT

Hi @ashidhingra,

if the down period is short (less than the time frame of the search), you can use a search like the one you shared.

Otherwise you need a different approach: if the locations (loc) to monitor are few you can use a search like this:

if instead you have many locs, you have to create a lookup (called e.g. perimeter.csv) containing all the locs to monitor with at least one column (called "loc") and schedule a search like the following:

Ciao.

Giuseppe

Re: alarms when count = 0

ashidhingra — Wed, 22 Jun 2022 06:33:18 GMT

Awesome, you are the best!!!