Alerting
Highlighted

Alerts searching for statistics - not events

Path Finder

Hello Team,

I have a search which is returning statistics (not events).
I would like to generate alert and call custome bash script only in case where i have at least 1 statistic result like this:

alt text

While i do not want to call external script when having 0 statistic results like this:

alt text

Please keep in mind that for both we do have 1 event found - and that is irrelevant.

I have read:
http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/Configuringalertsinsavedsearches.conf

And can see: "Alerts use a saved search to look for events". But in my case i am not interested in events but statistics.
Possible ?

How to launch external script easily in case i have a match and statistic data is produced ?

Thanks,
Michal

0 Karma
Highlighted

Re: Alerts searching for statistics - not events

SplunkTrust
SplunkTrust

Save the search as an alert, set the alert to trigger when there is more than zero results, and have the alert call your external script as an alert action.

I'd recommend doing that through the UI, but if you want to use savedsearches.conf directly these are some relevant settings:
http://docs.splunk.com/Documentation/Splunk/6.4.3/admin/savedsearchesconf#Notification_options - the value might be "number of events", but it's actually triggering based on number of results
http://docs.splunk.com/Documentation/Splunk/6.4.3/admin/savedsearchesconf#Settings_for_script_action

View solution in original post

0 Karma
Highlighted

Re: Alerts searching for statistics - not events

Path Finder

Hi Martin,

I do not see that option in UI, is that possible because of the fact that i have free/trial version in the lab ?
(while full/entrprise in the production) ?

Can i still do it via conf files in CLI ?

alt text

Thanks,

0 Karma
Highlighted

Re: Alerts searching for statistics - not events

SplunkTrust
SplunkTrust

Splunk Free doesn't have alerting.

0 Karma