Alerting
Highlighted

Configure an alert based on the number of results as warning, high, critical in same alert

Path Finder

I want to configure an alert with different thresholds as in

Warning - count > 5
High - count > 10
Critical - Count > 15

If there are 10 results in the count then I need to get an alert saying it is critical not the the warning and high.

0 Karma
Highlighted

Re: Configure an alert based on the number of results as warning, high, critical in same alert

Esteemed Legend

Add this to the end of your search:

| eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")

Then in your email you can use $result.criticality$ in your subject line and count>5 for your threshold.

View solution in original post

Highlighted

Re: Configure an alert based on the number of results as warning, high, critical in same alert

Path Finder

What does N/A means here?
The subject looks like this:
Working On it N/A
It should say Working On it Critical as the results are around 20

0 Karma
Highlighted

Re: Configure an alert based on the number of results as warning, high, critical in same alert

Esteemed Legend

You used both count and Count; make sure that the search is correct and that it generates the correct value for criticality based on Count/count and then it should work.

0 Karma
Highlighted

Re: Configure an alert based on the number of results as warning, high, critical in same alert

Path Finder

This is how my query looks like after the search:

|eval time=strftime(time, "%m/%d/%y %I:%M:%S:%p") | table time,host,cip,csuristem,sip,sport,scstatus,scsubstatus,time_taken | eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")

Am I doing anything wrong here?

0 Karma
Highlighted

Re: Configure an alert based on the number of results as warning, high, critical in same alert

Esteemed Legend

You have not calculated a count field! Maybe something like this:

|eval time=strftime(_time, "%m/%d/%y %I:%M:%S:%p")
| stats count BY host c_ip cs_uri_stem s_ip s_port sc_status sc_substatus time_taken
| eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")
0 Karma
Highlighted

Re: Configure an alert based on the number of results as warning, high, critical in same alert

Path Finder

Sorry for keep bugging you on this. The criticality still showing me as N/A

0 Karma
Highlighted

Re: Configure an alert based on the number of results as warning, high, critical in same alert

Esteemed Legend

What I wrote ABSOLUTELY works. We are going to have to stop playing the "this isn't really my search" game and you'll have to post your real search if you need to get it right. For example, in your fragment you are calculating time but not using it....

0 Karma
Highlighted

Re: Configure an alert based on the number of results as warning, high, critical in same alert

SplunkTrust
SplunkTrust

You want to set Severity based on count OR will a Text in subject line with Severity is ok?

0 Karma
Highlighted

Re: Configure an alert based on the number of results as warning, high, critical in same alert

Path Finder

Based on count

0 Karma