Alerting

Custom Condition in Alert

pdash
Path Finder

I want to have a custom condition where am comparing two fields of my search. One returns the current day (%e) and the other returns date_mday. How do I write this condition because %e has a space before it. So should it be like this?

search currentday = " "+date_mday

How to concatenate the space or is there a way i can get the current day without that space or a zero

Tags (1)

pdash
Path Finder

Found the solution. So in this alert I wanted to compare date_mday with my Today field and trigger an alert when it happens today. Here goes the details

The query would be:
index=_internal source=*license_usage.log type=Usage | eval MB=b/1024/1024 | stats sum(MB) as TotalMBUsed by pool, date_mday|eval Today=trim((strftime(now(), "%e")), " ")| eval MBExceededBy = 512000 - TotalMBUsed |eval MBAvailable = 512000 |eval Environment = "DEV" |eval TriggeredOn = if((match(date_mday,Today)), "Today", date_mday)|where TotalMBUsed > 512000

Time Range is @mon to now

Custom Condtion is "search TriggeredOn = Today"

This would trigger the alert on the day a violation occurs and the alert table will have all the violation of that month so that you know how many violations you have done in this month.

pdash
Path Finder

Just found out in alert condition you need to use . to concatenate search currentday = " ".date_mday

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...