Alerting

Alerts: Getting Multiple Values into Alert

vinodmadaan
Path Finder

Hi Guys,

I am not sure if this has been asked before (as I couldn't find anything on this issue).

I am working on a issue in which I have to create an alert for the thread count from 6 different servers, they come in as different log entries into splunk. So what I am looking for is a way to get these 6 values into the alert and trigger if any of these 6 crosses the threshold (one of the possible solution is creating 6 alerts and keeping track of each server separately, but I am looking for a way to get this done through one Alert only).

Is it possible?

Thanks in advance!

0 Karma
1 Solution

rechteklebe
Path Finder

Index=$yourindex host=host1 OR host=host2 OR host=host3 OR host=host4 OR host=host5 OR host=host6 $everythingelsetofindthethreaddata | stats max(Threads) as "maxthreads" by host | search "maxthreads"> $threshold

View solution in original post

rechteklebe
Path Finder

Index=$yourindex host=host1 OR host=host2 OR host=host3 OR host=host4 OR host=host5 OR host=host6 $everythingelsetofindthethreaddata | stats max(Threads) as "maxthreads" by host | search "maxthreads"> $threshold

vinodmadaan
Path Finder

it worked as needed, thanks 🙂

0 Karma

somesoni2
Revered Legend

Do the Threadcount from these 6 servers (assuming they are forwarders) go to central indexer(s)?

0 Karma

vinodmadaan
Path Finder

yes they go to a central indexer.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...