topic Re: Send Alert if # does not = 4 in Splunk Search

Send Alert if # does not = 4

taylormade2169 — Fri, 03 Jan 2014 17:35:45 GMT

What i am trying to do is send an alert if Alive_Iwalls does not equal 4. This will tell me if all of the firewalls are up and running. Any help would be greatly appreachiated.

sourcetype=SidewinderFirewall Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net | stats count by hostname | sort by count | stats count AS Alive_Iwalls | eval status = if(Alive_Iwalls == 4, "OK", "Error") | sendemail to="michael@SPL.com" if(status== error)

Re: Send Alert if # does not = 4

dwaddle — Fri, 03 Jan 2014 17:44:36 GMT

What you need to do is pull part of your search into the alert condition of your alert. Use a search more like:

sourcetype=SidewinderFirewall 
Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net 
| stats count by hostname

Then, when defining the scheduled search + alert, set an alert condition on "number of events" -> "does not equal" -> "4"

Then set the alert action to be the email, or any other action you need.

See docs at http://docs.splunk.com/Documentation/Splunk/5.0.2/Alert/Definescheduledalerts

Re: Send Alert if # does not = 4

linu1988 — Mon, 28 Sep 2020 15:34:35 GMT

sourcetype=SidewinderFirewall Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net | stats count by hostname | sort by count | stats count AS Alive_Iwalls |Where Alive_Iwalls != 4

No conditions required anymore