Alerting

Generate a alert when the Status field change from three or more faliures to success.

godman
Path Finder

In the events we have Status Field where the values are Success and Failures and I want an alert when the Status field changes from 3 or more consecutive failures to Success.

Tags (2)
0 Karma
1 Solution

@godman, slightly different approach than @renjith.nair's answer as it looks for 3 or more failures before success in the final where clause.

| gentimes start=-20 increment=1d
| eval _time=starttime
| fields _time
| appendcols [| makeresults
| eval status="success,failed,failed,failed,success,success,success,failed,failed,success,failed,failed,failed,success,success,failed,failed,failed,failed,success" 
| makemv delim="," status 
| mvexpand status]
| streamstats count by status reset_on_change=true
| reverse
| streamstats last(status) as nextStatus current=f window=1
| where nextStatus="success" and count>=3

PS: Depending on the chronological or reverse chronological sort of actual data the reverse command might need to be changed. The above run anywhere example generates chronological sorted events by default. Commands from |gentimes till | mvexpand status] generate some sample status with time.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

@godman, slightly different approach than @renjith.nair's answer as it looks for 3 or more failures before success in the final where clause.

| gentimes start=-20 increment=1d
| eval _time=starttime
| fields _time
| appendcols [| makeresults
| eval status="success,failed,failed,failed,success,success,success,failed,failed,success,failed,failed,failed,success,success,failed,failed,failed,failed,success" 
| makemv delim="," status 
| mvexpand status]
| streamstats count by status reset_on_change=true
| reverse
| streamstats last(status) as nextStatus current=f window=1
| where nextStatus="success" and count>=3

PS: Depending on the chronological or reverse chronological sort of actual data the reverse command might need to be changed. The above run anywhere example generates chronological sorted events by default. Commands from |gentimes till | mvexpand status] generate some sample status with time.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

renjith_nair
SplunkTrust
SplunkTrust

@godman,

Are you looking for something similar to

|makeresults|eval status="success,failed,failed,failed,success,failed,failed,success,failed"|makemv delim="," status|mvexpand status
|streamstats count by status reset_on_change=true|delta count as difference|where difference==-2 AND status=="success"
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...