Alerting

Conditional Alerting

Communicator

I am trying to indicate that a problem has been resolved or is no longer an issue. What I want to do is have an alert that searches to see if a specific alert has triggered in the last 10 minutes. If it HAS then I want to do a secondary search to look for all alerts that begin with the prefix "PLCYSVCSbindqtesvc" I want the alert to fire an e-mail if 1 or less alerts with the prefix PLCYSVCSbindqtesvc" have been fired. I have been using the below search, but I cannot get it to function in the manner I need. Please help:

index=audit action=alertfired ssapp=* ssname=* triggeredalerts=1 [search index=audit action=alertfired ssapp=* ssname=PLCYSVCSbindqtesvcREDstatusSeanTEST triggeredalerts=1 | stats count AS count ssname applog | where count > 0 | table app_log] earliest=-10m@m | stats count | where count < 2

0 Karma

SplunkTrust
SplunkTrust

Try this

index=_audit action=alert_fired ss_app=* ss_name=PLCY_SVCS_bindqtesvc_RED_status_Sean_TEST triggered_alerts=1 | stats count | where count > 0 
| map maxsearches=1 search="search index=_audit action=alert_fired ss_app=* ss_name=PLCY_SVCS_bindqtesvc* triggered_alerts=1 | stats count | where count <2"

Here, first the count of events with ss_name=PLCY_SVCS_bindqtesvc_RED_status_Sean_TEST is calculated. If count > 0 then next search will get executed to get the count of alerts for ssname with prefix `PLCYSVCS_bindqtesvc`. You can set alert to get trigged if there are any rows retured by the search (it will return one rows with column as count if all conditions are true)

0 Karma