Alerting

Can I write a single search for populating summary index and creating alerts?

Contributor

Hi,

Wanted to know if we can have a single search to populate the summary index and also to create an alert based on the search results.

We have a search for windows event logs for servers to see if some event has occurred.

index=main | stats count  by host|  eval health=if(count > 1," RED", "GREEN") 

We want to write both GREEN and RED events to the summary table but want to alert only for RED ones, is it possible to do this with just one search or shall we create two different searches?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

hello there,

the answer is yes, however, before you proceed, consider the following search as it will be super fast and can be ran on very long periods of time without need to summarize:

| tstats count where index=main by host 
| eval health=if(count > 1," RED", "GREEN")

run a search with the collect command to collect data to summary index, see example below with testmode=true

   index=main 
    | stats count by host 
    | eval health=if(count > 1," RED", "GREEN") 
    | collect index=summary testmode=true

screenshot:
alt text

save as alert and add condition, screenshot:

alt text

configure to run every X interval and it will populate your summary index and alert if condition met

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

hello there,

the answer is yes, however, before you proceed, consider the following search as it will be super fast and can be ran on very long periods of time without need to summarize:

| tstats count where index=main by host 
| eval health=if(count > 1," RED", "GREEN")

run a search with the collect command to collect data to summary index, see example below with testmode=true

   index=main 
    | stats count by host 
    | eval health=if(count > 1," RED", "GREEN") 
    | collect index=summary testmode=true

screenshot:
alt text

save as alert and add condition, screenshot:

alt text

configure to run every X interval and it will populate your summary index and alert if condition met

View solution in original post

0 Karma