topic Re: How do I trigger alert if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10? in Splunk Search

How do I trigger alert if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10?

majilan1 — Mon, 01 Aug 2022 20:07:34 GMT

Hi,

I want the alert to trigger if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10

Is there anybody can help with this please?

My search is,

index=A source=B sourcetype=c | fillnull value=0 TOTAL_PIECES RETRIEVAL_ATTEMPT | where RETRIEVAL_ATTEMPT= 10 | rename "SASP_CTRL_SEQ_NBR" as "Extract_Seq_ID" ,"IV_STS" as "IV_Status", "RETRIEVAL_ATTEMPT" as "Retrieval_Attempt","PSTG_STMT_N" as "Pos_St","TOTAL_PIECES" as "Piece_Count" | table "Extract_Seq_ID","IV_Status","Retrieval_Attempt","Pos_St","Piece_Count"

Re: How do I trigger alert if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10?

gcusello — Tue, 02 Aug 2022 06:44:20 GMT

Hi @majilan1,

if your search is correctly running, you have only to save it ("Save As")with the scheduling you need, what's the problem?

Ciao.

Giuseppe

Re: How do I trigger alert if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10?

isoutamo — Tue, 02 Aug 2022 07:29:49 GMT

Just like @gcusello said. Use Save As after you have run your SPL query ( add "AND TOTAL_PIECES > 0" to your where line). Then add Trigger Conditions when there are more than 0 results.

r. Ismo

Re: How do I trigger alert if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10?

majilan1 — Tue, 02 Aug 2022 12:09:19 GMT

Alert should trigger if:

There are any extracts where TOTAL_PIECES is >0 and the RETRIEVAL_ATTEMPT is = 10.

I added AND TOTAL_PIECES > 0, but I'm not getting no result. The thing is when I move that TOTAL_PIECES is >0 I get some data, but I need to trigger based on the condition above.

Thanks

Re: How do I trigger alert if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10?

majilan1 — Tue, 02 Aug 2022 13:48:52 GMT

Thanks! It works, I forgot to add the second part of the condition: TOTAL_PIECES > 0.

Re: How do I trigger alert if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10?

gcusello — Tue, 02 Aug 2022 13:49:00 GMT

Hi @majilan1.

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: How do I trigger alert if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10?

majilan1 — Tue, 02 Aug 2022 13:56:14 GMT

Thanks, you guys have been a great helping solve these problems.