Alerting

Alert based on the value of a field

bshamsian
Path Finder

Can someone tell me or point me in the direction of setting up an alert based on the value of a field. Basically the field is an integer indicating some queue size and if it goes above some threshold I would like an alert/email be sent out.

cburr2012
Path Finder

bshamsian,

I think you want to do something like this.

index=this_index query_terms_here | stats count by value | where value>10

Then just set your alert to trigger when # of events is greater than 0.

(example)

index="Windows" sourcetype=WinEventLog:Security | stats count by host | where host>100

Then set your alert.

Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...