Alerting

Alerts searching for statistics - not events

teknet9
Path Finder

Hello Team,

I have a search which is returning statistics (not events).
I would like to generate alert and call custome bash script only in case where i have at least 1 statistic result like this:

alt text

While i do not want to call external script when having 0 statistic results like this:

alt text

Please keep in mind that for both we do have 1 event found - and that is irrelevant.

I have read:
http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/Configuringalertsinsavedsearches.conf

And can see: "Alerts use a saved search to look for events". But in my case i am not interested in events but statistics.
Possible ?

How to launch external script easily in case i have a match and statistic data is produced ?

Thanks,
Michal

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Save the search as an alert, set the alert to trigger when there is more than zero results, and have the alert call your external script as an alert action.

I'd recommend doing that through the UI, but if you want to use savedsearches.conf directly these are some relevant settings:
http://docs.splunk.com/Documentation/Splunk/6.4.3/admin/savedsearchesconf#Notification_options - the value might be "number of events", but it's actually triggering based on number of results
http://docs.splunk.com/Documentation/Splunk/6.4.3/admin/savedsearchesconf#Settings_for_script_action

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Save the search as an alert, set the alert to trigger when there is more than zero results, and have the alert call your external script as an alert action.

I'd recommend doing that through the UI, but if you want to use savedsearches.conf directly these are some relevant settings:
http://docs.splunk.com/Documentation/Splunk/6.4.3/admin/savedsearchesconf#Notification_options - the value might be "number of events", but it's actually triggering based on number of results
http://docs.splunk.com/Documentation/Splunk/6.4.3/admin/savedsearchesconf#Settings_for_script_action

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Splunk Free doesn't have alerting.

0 Karma

teknet9
Path Finder

Hi Martin,

I do not see that option in UI, is that possible because of the fact that i have free/trial version in the lab ?
(while full/entrprise in the production) ?

Can i still do it via conf files in CLI ?

alt text

Thanks,

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...