Alerting

Configure an alert based on the number of results as warning, high, critical in same alert

chandrasekharko
Path Finder

I want to configure an alert with different thresholds as in

Warning - count > 5
High - count > 10
Critical - Count > 15

If there are 10 results in the count then I need to get an alert saying it is critical not the the warning and high.

0 Karma
1 Solution

woodcock
Esteemed Legend

Add this to the end of your search:

| eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")

Then in your email you can use $result.criticality$ in your subject line and count>5 for your threshold.

View solution in original post

somesoni2
Revered Legend

You want to set Severity based on count OR will a Text in subject line with Severity is ok?

0 Karma

chandrasekharko
Path Finder

Based on count

0 Karma

woodcock
Esteemed Legend

Add this to the end of your search:

| eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")

Then in your email you can use $result.criticality$ in your subject line and count>5 for your threshold.

chandrasekharko
Path Finder

What does N/A means here?
The subject looks like this:
Working On it N/A
It should say Working On it Critical as the results are around 20

0 Karma

woodcock
Esteemed Legend

You used both count and Count; make sure that the search is correct and that it generates the correct value for criticality based on Count/count and then it should work.

0 Karma

chandrasekharko
Path Finder

This is how my query looks like after the search:

|eval time=strftime(_time, "%m/%d/%y %I:%M:%S:%p") | table time,host,c_ip,cs_uri_stem,s_ip,s_port,sc_status,sc_substatus,time_taken | eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")

Am I doing anything wrong here?

0 Karma

woodcock
Esteemed Legend

You have not calculated a count field! Maybe something like this:

|eval time=strftime(_time, "%m/%d/%y %I:%M:%S:%p")
| stats count BY host c_ip cs_uri_stem s_ip s_port sc_status sc_substatus time_taken
| eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")
0 Karma

chandrasekharko
Path Finder

Sorry for keep bugging you on this. The criticality still showing me as N/A

0 Karma

woodcock
Esteemed Legend

What I wrote ABSOLUTELY works. We are going to have to stop playing the "this isn't really my search" game and you'll have to post your real search if you need to get it right. For example, in your fragment you are calculating time but not using it....

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...