Alerting

Custom Condition in Alert

pdash
Path Finder

I want to have a custom condition where am comparing two fields of my search. One returns the current day (%e) and the other returns date_mday. How do I write this condition because %e has a space before it. So should it be like this?

search currentday = " "+date_mday

How to concatenate the space or is there a way i can get the current day without that space or a zero

Tags (1)

pdash
Path Finder

Found the solution. So in this alert I wanted to compare date_mday with my Today field and trigger an alert when it happens today. Here goes the details

The query would be:
index=_internal source=*license_usage.log type=Usage | eval MB=b/1024/1024 | stats sum(MB) as TotalMBUsed by pool, date_mday|eval Today=trim((strftime(now(), "%e")), " ")| eval MBExceededBy = 512000 - TotalMBUsed |eval MBAvailable = 512000 |eval Environment = "DEV" |eval TriggeredOn = if((match(date_mday,Today)), "Today", date_mday)|where TotalMBUsed > 512000

Time Range is @mon to now

Custom Condtion is "search TriggeredOn = Today"

This would trigger the alert on the day a violation occurs and the alert table will have all the violation of that month so that you know how many violations you have done in this month.

pdash
Path Finder

Just found out in alert condition you need to use . to concatenate search currentday = " ".date_mday

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...