Alerting

Alerts searching for statistics - not events

teknet9
Path Finder

Hello Team,

I have a search which is returning statistics (not events).
I would like to generate alert and call custome bash script only in case where i have at least 1 statistic result like this:

alt text

While i do not want to call external script when having 0 statistic results like this:

alt text

Please keep in mind that for both we do have 1 event found - and that is irrelevant.

I have read:
http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/Configuringalertsinsavedsearches.conf

And can see: "Alerts use a saved search to look for events". But in my case i am not interested in events but statistics.
Possible ?

How to launch external script easily in case i have a match and statistic data is produced ?

Thanks,
Michal

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Save the search as an alert, set the alert to trigger when there is more than zero results, and have the alert call your external script as an alert action.

I'd recommend doing that through the UI, but if you want to use savedsearches.conf directly these are some relevant settings:
http://docs.splunk.com/Documentation/Splunk/6.4.3/admin/savedsearchesconf#Notification_options - the value might be "number of events", but it's actually triggering based on number of results
http://docs.splunk.com/Documentation/Splunk/6.4.3/admin/savedsearchesconf#Settings_for_script_action

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Save the search as an alert, set the alert to trigger when there is more than zero results, and have the alert call your external script as an alert action.

I'd recommend doing that through the UI, but if you want to use savedsearches.conf directly these are some relevant settings:
http://docs.splunk.com/Documentation/Splunk/6.4.3/admin/savedsearchesconf#Notification_options - the value might be "number of events", but it's actually triggering based on number of results
http://docs.splunk.com/Documentation/Splunk/6.4.3/admin/savedsearchesconf#Settings_for_script_action

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Splunk Free doesn't have alerting.

0 Karma

teknet9
Path Finder

Hi Martin,

I do not see that option in UI, is that possible because of the fact that i have free/trial version in the lab ?
(while full/entrprise in the production) ?

Can i still do it via conf files in CLI ?

alt text

Thanks,

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...