Alerting

How do I trigger an alert if a continuously number repeats more than 5 times?

DataOrg
Builder

For example.
i have a field which has repeated numbers. if a number is repeated more than 5 times, i need to clear an alert.

for example if number "3" repeats more than 5 times. i need to filter it.

1
1
1
2
3
3
3
3
5

0 Karma
1 Solution

sudosplunk
Motivator

If you have a field called "X", then add something like below to your search and schedule your alert in a normal way.

...count(eval(X="3")) AS count_number BY sourcetype | where count_number > 5

View solution in original post

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @premranjithj, Were you able to test out either of these solutions? Did they work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

0 Karma

sudosplunk
Motivator

If you have a field called "X", then add something like below to your search and schedule your alert in a normal way.

...count(eval(X="3")) AS count_number BY sourcetype | where count_number > 5

DataOrg
Builder

3 is not a constant.. even if 2 was present more than 5 we need trigger alert. It will be like if a same number present more than 5 times . We need to trigger an alert

0 Karma

sudosplunk
Motivator

Can you paste some sample (actual looking events) data. Please mask unwanted information. I want to look at the actual field with value.

DataOrg
Builder

below is the example. we need to refer column inc_value. if same number repeats more than 5 times. we need to trigger alert

datetime inc_value
24/08/2018 06:18 1
24/08/2018 06:20 1
24/08/2018 06:30 1
24/08/2018 06:33 1
24/08/2018 06:34 1
24/08/2018 06:38 1
24/08/2018 06:40 1
24/08/2018 06:45 1
24/08/2018 06:18 2
24/08/2018 06:21 2
24/08/2018 06:32 2
24/08/2018 06:22 3
24/08/2018 06:25 3
24/08/2018 06:39 3
24/08/2018 06:44 3
24/08/2018 06:21 4
24/08/2018 06:24 4
24/08/2018 06:31 4
24/08/2018 06:37 4
24/08/2018 06:42 4
24/08/2018 06:20 5
24/08/2018 06:21 5
24/08/2018 06:30 5
24/08/2018 06:31 5
24/08/2018 06:34 5
24/08/2018 06:35 5
24/08/2018 06:36 5
24/08/2018 06:37 5
24/08/2018 06:39 5
24/08/2018 06:40 5
24/08/2018 06:41 5
24/08/2018 06:42 5

0 Karma

sudosplunk
Motivator

See if this works, ...| stats count by inc_value | where count > 5

Below is the run anywhere search:

| makeresults | eval new = "24/08/2018 06:18 1
24/08/2018 06:20 1
24/08/2018 06:30 1
24/08/2018 06:33 1
24/08/2018 06:34 1
24/08/2018 06:38 1
24/08/2018 06:40 1
24/08/2018 06:45 1
24/08/2018 06:18 2
24/08/2018 06:21 2
24/08/2018 06:32 2
24/08/2018 06:22 3
24/08/2018 06:25 3
24/08/2018 06:39 3
24/08/2018 06:44 3
24/08/2018 06:21 4
24/08/2018 06:24 4
24/08/2018 06:31 4
24/08/2018 06:37 4
24/08/2018 06:42 4
24/08/2018 06:20 5
24/08/2018 06:21 5
24/08/2018 06:30 5
24/08/2018 06:31 5
24/08/2018 06:34 5
24/08/2018 06:35 5
24/08/2018 06:36 5
24/08/2018 06:37 5
24/08/2018 06:39 5
24/08/2018 06:40 5
24/08/2018 06:41 5
24/08/2018 06:42 5"
| rex max_match=0 field=new "\S+\s\S+\s(?<inc>\d)"
| stats count by inc
| where count > 5

vishaltaneja070
Motivator

you can run a query with
| stats count(field) by field

Which will give you output like this:
field count
1 3
2 1
3 5
4 3

Then you can create a alert based on count field with count>5 and pass the value of $field$ in result.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...