topic Re: Please help to setup alert in Splunk Search

Please help to setup alert?

bhaskar5428 — Mon, 27 Feb 2023 14:42:23 GMT

index=* ("ORC from FCS completed" OR "ORC from SDS completed." OR "ORC from ROUTER completed") namespace IN ("dk1692-b","dk1399-b","dk1371-b") | eval dk1692=if(searchmatch("\"ORC from ROUTER completed\" namespace=dk1692-b"),1,0) | eval dk1399=if(searchmatch("\"ORC from SDS completed\" namespace=dk1399-b"),1,0) | eval dk1371=if(searchmatch("\"ORC from FCS completed\" namespace=dk1371-b"),1,0) | stats sum(dk*) as dk* | search dk1692>90 OR dk1399>60 OR dk1371>60

Am getting attached output

Problem statement ,
i would like setup alert where ever specific namespace **bleep** goes below its threshold which mention in search query.

Re: Please help to setup alert

ITWhisperer — Mon, 27 Feb 2023 10:41:11 GMT

Your search is looking for values greater than specific values. Do these indicate that the namespace has gone below its threshold? If so, just copy the search into an alert and trigger when there are greater than zero results.

Re: Please help to setup alert

bhaskar5428 — Mon, 27 Feb 2023 10:54:07 GMT

Sorry , please check latest screen shot , in this wherever namespace value less than threashhod it shoud throw email alert

For example - dk1399 is 45 which is less than 60

Re: Please help to setup alert

ITWhisperer — Mon, 27 Feb 2023 11:00:51 GMT

OK, so the fact that this search returns any rows means that at least one of the namespaces is below its threshold. You can use this fact as the trigger in your alert

Re: Please help to setup alert

bhaskar5428 — Mon, 27 Feb 2023 12:03:13 GMT

Yes but there are three namespaces with different threshould

Do i have to setup 3 different alerts by using less than trigger ??

Re: Please help to setup alert

ITWhisperer — Mon, 27 Feb 2023 13:36:52 GMT

It depends on your requirement. You could have a single alert for any of them being below the threshold, or if you had them in different rows, you could still have a single alert that would trigger for each result.

| where dk1692<90 OR dk1399<60 OR dk1371<60 | eval _time=now() | untable _time namespace count | where (namespace="dk1692" and count<90) OR (namespace="dk1399" and count<60) OR (namespace="dk1371" and count<60)

Re: Please help to setup alert

bhaskar5428 — Tue, 28 Feb 2023 04:38:39 GMT

index=* ("ORC from FCS completed" OR "ORC from SDS completed." OR "ORC from ROUTER completed") namespace IN ("dk1692-b","dk1399-b","dk1371-b")
| eval dk1692=if(searchmatch("\"ORC from ROUTER completed\" namespace=dk1692-b"),1,0)
| eval dk1399=if(searchmatch("\"ORC from SDS completed\" namespace=dk1399-b"),1,0)
| eval dk1371=if(searchmatch("\"ORC from FCS completed\" namespace=dk1371-b"),1,0)
| stats sum(dk*) as dk*
| search dk1692<90 OR dk1399<60 OR dk1371<60
| eval _time=now()
| untable _time namespace count
| where (namespace="dk1692" and count<90) OR (namespace="dk1399" and count<60) OR (namespace="dk1371" and count<60)

-------------------------------------------------------------------------------------------------------------

this query good as per my requirement , however how can i setup alert with trigger

Because its giving one row and count.

for setting up condition can i use
number of results - is greater than = 0

*** So whenever there is record in above query it will send alert.

Re: Please help to setup alert

bhaskar5428 — Tue, 28 Feb 2023 05:45:08 GMT

index=* ("ORC from FCS completed" OR "ORC from SDS completed." OR "ORC from ROUTER completed" OR "ORC from EMS completed" OR "ORC from TDS completed") namespace IN ("dk1692-b","dk1399-b","dk1371-b","dk1398-b","dk1400-c")
| eval dk1692=if(searchmatch("\"ORC from ROUTER completed\" namespace=dk1692-b"),1,0)
| eval dk1399=if(searchmatch("\"ORC from SDS completed\" namespace=dk1399-b"),1,0)
| eval dk1371=if(searchmatch("\"ORC from FCS completed\" namespace=dk1371-b"),1,0)
| eval dk1398=if(searchmatch("\"ORC from EMS completed\" namespace=dk1398-b"),1,0)
| eval dk1400=if(searchmatch("\"ORC from TDS completed\" namespace=dk1400-c"),1,0)
| stats sum(dk*) as dk*
| search dk1692<90 OR dk1399<60 OR dk1371<60 OR dk1398<60 OR dk1400<60
| eval _time=now()
| untable _time namespace count
| where (namespace="dk1692" and count<90) OR (namespace="dk1399" and count<60) OR (namespace="dk1371" and count<60) OR (namespace="dk1398" and count<60) OR (namespace="dk1400" and count<60)

----------------------------------------------------------------------------------------------------------------

Thanks in above query , i would like to add one more column which says which namespace is below threshold

example if namespace dk1399-b below 60 it column is should show name SDS

Re: Please help to setup alert

ITWhisperer — Tue, 28 Feb 2023 08:00:16 GMT

If you also set "For each result", you will get a triggered action for each row i.e. each namespace that is below its threshold

You would need to set an action to be triggered, e.g. an email being sent for each trigger.

Re: Please help to setup alert

bhaskar5428 — Tue, 28 Feb 2023 08:27:47 GMT

I would like to use throttle option

But when am using each result option for trigger its asking field name suppressing.

how to manage that ?

Re: Please help to setup alert

ITWhisperer — Tue, 28 Feb 2023 08:43:10 GMT

You could try

namespace = $result.namespace$

Re: Please help to setup alert

bhaskar5428 — Tue, 28 Feb 2023 09:01:25 GMT

you mean i need to add value

namespace = $result.namespace$

into Suppress results containing field value ??

please confirm

Re: Please help to setup alert

ITWhisperer — Tue, 28 Feb 2023 09:06:15 GMT

That is what I mean - give it a try 😀

Re: Please help to setup alert

bhaskar5428 — Tue, 28 Feb 2023 11:51:24 GMT

Thank you so much