topic Re: retrieve host count depending on host value in Splunk Search

retrieve host count depending on host value

marcosrios — Wed, 06 Apr 2016 13:38:03 GMT

Hi, I'm trying to accomplish the following:
* alert when there is a host that has less than 2 occurences
* alert when the total count is less than 12

index=vts sourcetype=vtsr host=server* "Batch Processor is turned ON" | stats count(host) as hostCount by host | addcoltotals labelfield=host

host               hostCount
server 1           3
server 2           3
server 3           2
server 4           2
server 5           2
server 6           2
Total              14

How can I validate for each server and total count values just to specify when to trigger the alert?

Regards!

Re: retrieve host count depending on host value

woodcock — Wed, 06 Apr 2016 13:45:26 GMT

Add this on:

... | eventstats count(eval(host!="Total" AND hostCount<2)) AS Trigger1 last(hostCount) AS Trigger2

Then trigger your alert on "Trigger1>0 AND Trigger2<12"

Re: retrieve host count depending on host value

mlf — Wed, 06 Apr 2016 13:55:56 GMT

Just set a custom condition on the alert:

search (host!=Total AND hostCount<2) OR (host=Total AND hostCount<12)

Re: retrieve host count depending on host value

somesoni2 — Wed, 06 Apr 2016 14:06:35 GMT

Give this a try

 index=vts sourcetype=vtsr host=server* "Batch Processor is turned ON" | stats count(host) as hostCount by host | eventstats sum(hostCount) as total | where hostCount<2 OR total<12