Alerting

Alert based on number of events after charting the results

ilyashussain
Engager

I am a newbie on Splunk and have been trying to create an alert using the following search:

index=prodenvs source=prodlogs "transaction timeout"

I had setup it to cron every 5 mins and check past 5 mins and alert if the count goes more than 10. The alert was working fine but I wanted to summarize the results based on hosts.

index=prodenvs source=prodlogs "transaction timeout" | chart count by host

The alert stopped working after I changed it and I noticed that the alert criteria is taking number of hosts as the "count" now. Can I still use the alert feature based on the number of events and yet be able to chart my results? Any help is greatly appreciated.

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can set this as a custom alert condition:

stats sum(count) as sum | where sum > 10
0 Karma

strive
Influencer

Now you can set the alert using sum(count)

we will be able to provide clear answer if you can give us some more details

0 Karma

strive
Influencer

Where did you set the alerts? Is it on splunk web OR some custom script OR ?
Can you provide some more details

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...