Alerting

Alert with 3 different threshold for 3 different event in on alert

cbiraris
Path Finder

Hi team,

I need help to create a query with with 3 different threshold for 3 different event in single splunk alert.

for example :

index= abc
sourcetype=xyz

"warning" OR "Error" OR Critical

If any of these ("warning" OR "Error" OR Critical) occurred 5 times in events in last 15 minutes alert should be triggered .


 

Labels (2)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @cbiraris ,

I suppose that these three values are in a field (e.g. type), so you can run a search like the folowing:

index= abc sourcetype=xyz type IN ("warning", "Error", Critical)
| stats
    values(eval(type="warning")) AS warning_count
    values(eval(type="Error")) AS Error_count
    values(eval(type="Critical")) AS Critical_count
| where warning_count>5 OR Error_count>5 OR Critical_count>5

you can aso setup a different threshold for each type of message.

If you don't have the three values in a fied, you have to use a similar search:

index= abc sourcetype=xyz ("warning" OR "Error" OR Critical)
| stats
    values(eval(searchmatch("warning"))) AS warning_count
    values(eval(searchmatch("Error"))) AS Error_count
    values(eval(searchmatch("Critical"))) AS Critical_count
| where warning_count>5 OR Error_count>5 OR Critical_count>5

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @cbiraris ,

I suppose that these three values are in a field (e.g. type), so you can run a search like the folowing:

index= abc sourcetype=xyz type IN ("warning", "Error", Critical)
| stats
    values(eval(type="warning")) AS warning_count
    values(eval(type="Error")) AS Error_count
    values(eval(type="Critical")) AS Critical_count
| where warning_count>5 OR Error_count>5 OR Critical_count>5

you can aso setup a different threshold for each type of message.

If you don't have the three values in a fied, you have to use a similar search:

index= abc sourcetype=xyz ("warning" OR "Error" OR Critical)
| stats
    values(eval(searchmatch("warning"))) AS warning_count
    values(eval(searchmatch("Error"))) AS Error_count
    values(eval(searchmatch("Critical"))) AS Critical_count
| where warning_count>5 OR Error_count>5 OR Critical_count>5

Ciao.

Giuseppe

cbiraris
Path Finder

Thank you this one working for me 🙂 

0 Karma

cbiraris
Path Finder

Yes, only if any of them individually occur 5 times e.g. 5 warnings or 5 errors or 5 criticals

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please clarify your requirement - do you want the alert to trigger if any of the values occurs 5 times e.g. 2 warnings, 2 errors and 1 critical, or only if any of them individually occur 5 times e.g. 5 warnings or 5 errors or 5 criticals?

cbiraris
Path Finder

Yes, only if any of them individually occur 5 times e.g. 5 warnings or 5 errors or 5 criticals

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...