Alerting

Alerting: customized conditions, memory is above a threshold for two times in a row for a specific server

jaimelopez
Explorer

Hello,
I have the next query in an alert to check the status of 6 hosts:
index=idx_nmon_data sourcetype=Perfmon:Memory eventtype=perfmon_memory
| eval threshold=95
| where mem_used > threshold
| table _time host mem_used threshold

I would like that the alert is triggered when for two times in a row a specific server is above 95% of mem_used.

And that in the email appears the next fields: _time host mem_used threshold
I thought about two options but they dont match exactly what I want:
- Do a: stats dc(_time) as times by host (in the search) and configure alert triggered when results are >1
>>>but in this case i lose information in the email of mem_used and _time, and I would like to see them in the table of the email

          - Inside the alert, as customized condition, to write: search dc(_time) by host > 1, but it does not work

Anyone has othe ideas? or am i doing something wrong?

I would like to maintain as well this is an only one query just to avoid consume the ressources of my search head server

Thanks in advance
Jaime

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...