Alerting

How do i trigger a search if results count of another search are greater than 0?

jkat54
SplunkTrust
SplunkTrust

I have data coming into an index that tells me when a load is complete... these files are named *_done.txt

I have data coming into the same index that tells me the counts of errors etc related to the loads.

I want to trigger an alert that contains the errors that occurred in the load but only after the load completes and splunk receives a file with source=*_done.txt.

How can I do this?

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust
[ 
makeresults count=1 
| eval trigger= [ search index=myindexsource=*_done.txt _index_earliest=-1h@h _index_latest=-0h@h | head 1 | stats count  | return $count]
| eval search=if( trigger > 0 , "Search to Run if results Count is greater than 0","search to run if results count is not greater than 0, could be null()")
]

I solved with the above

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust
[ 
makeresults count=1 
| eval trigger= [ search index=myindexsource=*_done.txt _index_earliest=-1h@h _index_latest=-0h@h | head 1 | stats count  | return $count]
| eval search=if( trigger > 0 , "Search to Run if results Count is greater than 0","search to run if results count is not greater than 0, could be null()")
]

I solved with the above

0 Karma

jkat54
SplunkTrust
SplunkTrust

You can use this approach too:

| where trigger>0
| map search=“search to trigger”

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...