Alerting

Help in setting alert

vrmandadi
Builder

Hello,

I am setting an alert based on the count i.e if the count is greater than 50 then we need to generate an alert.

I wrote the query and saved as alert

alert type=Real time
Trigger Condition=Custom
Custom Condition= search count>50
time: in 5 mins
and then selected the e-mail as triggered condition

in Throttle what should I give such that the alert when generated in 5 minutes should set the time back to zero before generating another alert

Tags (4)
0 Karma

ChrisG
Splunk Employee
Splunk Employee

If your search is scheduled to run every five minutes (is it, actually?), then set the throttling to suppress the alert to something greater than five minutes.

0 Karma

vrmandadi
Builder

its not every 5 minutes,it will alert if the count is greater than 50 in a 5 mins window

0 Karma

ChrisG
Splunk Employee
Splunk Employee

So what is the schedule you have set for the search itself?

0 Karma

vrmandadi
Builder

all time for search,the alert is customized

search count>50

is the syntax correct for the alert or should it be in double quotes

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @vrmandadi,
I think it might be helpful to reconsider the alerting behavior you would like to have. When you say, "set the time back to zero" in your original question, it makes me think that you might want a scheduled alert that runs a search every five minutes to check for more than 50 events. If there are more than 50 results for that search, you get an email notification. Does that sound more like the outcome you are trying to set up? Let me know either way and I can suggest some resources.

As a start, this comparison chart might help.
http://docs.splunk.com/Documentation/Splunk/6.4.0/Alert/AlertTypesOverview

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>