topic a problem about sub search in Splunk Search

a problem about sub search

crazyeva — Mon, 28 Sep 2020 12:09:56 GMT

Hi~ masters
There is case as:
When events count of last 5 min is greater than an average count of 1 hour before (count-of-1h/12), trigger a email alert
I tried this:
summary index:
index="_internal" | fields | sistats count
named Count5magain1h, scheduled every 5min, then:
index=summary search_name=Count5magain1h | sort -_time limit=13 |stats count| rename count as countof65m |
eval Average = (countof65m - [search index=summary search_name=Count5magain1h | sort -_time limit=1 | stats count | rename count as countof5m | return countof5m])/12 |
eval Result=case(countof5m>2*Average,1,countof5m<2*Average,0)

this seems not going to work! I must have mistaken syntax of search
Could someone help me thanks~

Re: a problem about sub search

lguinn2 — Mon, 30 Jul 2012 05:02:59 GMT

So I am not sure I understand your question, but try this:

yoursearchhere earliest=-65m latest=-5m
| bucket _time span=5m
| stats count as FiveMinCount by _time
| stats avg(FiveMinCount) as avgCount
| appendcols [ search yoursearchhere  earliest=-5m
   | stats count as currentCount ]

I don't understand why you are searching the _internal index. In my example above, I have inserted yoursearchhere where your search criteria should go.

Also your custom condition on the alert should be

where currentCount > avgCount

HTH

Re: a problem about sub search

crazyeva — Tue, 31 Jul 2012 03:54:03 GMT

Thank you very much! I am not good at expressing...
But that exactly solved my problem, and helped me with the usage of Splunk