Alerting

Alert condition - Continuous failure

vijaysri
Contributor

Hi,

I need an alert to be created, which should trigger only if we receive continuous failures for 5 times within a span of 10 mins.

1) Trigger alert

failure

failure

failure

failure 

failure

 

2) do not trigger alert

failure

failure

failure

failure

success

failure

failure

failure

failure

success

Labels (2)
0 Karma
1 Solution

ITWhisperer
Ultra Champion

You could do something around:

 

| autoregress status p=1-4
| where status = "failure" and status_p1 = "failure" and status_p2 = "failure" and status_p3 = "failure" and status_p4 = "failure"

 

View solution in original post

ITWhisperer
Ultra Champion

You could do something around:

 

| autoregress status p=1-4
| where status = "failure" and status_p1 = "failure" and status_p2 = "failure" and status_p3 = "failure" and status_p4 = "failure"

 

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!