Alerting

Alert help needed - Filtered events are still appearing

606866581
Path Finder

Hi,
I only want my alert to trigger if a particular field value has failed 2 or more times in the last 50 occurances. My current search is:

sourcetype=mySource ST_Script="myScript.py" ST_LogType="Step Log" | dedup 50 ST_Comment | search ST_Status=Fail | stats count AS FailuresInLast50 by ST_Comment | where FailuresInLast50 >= 2  

From the statistics tab this search appears to do what I wanted because only fields with 2 or more failures are appearing:

alt text

However when I go to create my alert condition (FailuresInLast50 count >= 2) I get an error because it can't parse my alert condition. I assume I'm going about this in slightly the wrong way, so some guidance would be much appreciated.
Thanks

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

You are trying to do the same thresh-holding work twice: once in your search and once in your alert trigger. You need to pick one place or the other. So let's keep your search exactly as it is. In this case, you need your alert Trigger condition to be Number of Results is Greater than 0. If you think about it, you will see what I mean but if not, just trust me and configure it this way and it will work.

View solution in original post

woodcock
Esteemed Legend

You are trying to do the same thresh-holding work twice: once in your search and once in your alert trigger. You need to pick one place or the other. So let's keep your search exactly as it is. In this case, you need your alert Trigger condition to be Number of Results is Greater than 0. If you think about it, you will see what I mean but if not, just trust me and configure it this way and it will work.

606866581
Path Finder

Thanks for your answer, I'll give it a go and report back!

0 Karma

the_wolverine
Champion

LOL. Sometimes that's how you have to explain it.

0 Karma

yannK
Splunk Employee
Splunk Employee

You asked all valued that are 2 or higher, therefore having events with where FailuresInLast50=2 is expected.
Are you sure tat all your values are not 2 ?
Can you run the same search without the "where" condition then see if you have values >2

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...