Alerting

How do i trigger a search if results count of another search are greater than 0?

jkat54
SplunkTrust
SplunkTrust

I have data coming into an index that tells me when a load is complete... these files are named *_done.txt

I have data coming into the same index that tells me the counts of errors etc related to the loads.

I want to trigger an alert that contains the errors that occurred in the load but only after the load completes and splunk receives a file with source=*_done.txt.

How can I do this?

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust
[ 
makeresults count=1 
| eval trigger= [ search index=myindexsource=*_done.txt _index_earliest=-1h@h _index_latest=-0h@h | head 1 | stats count  | return $count]
| eval search=if( trigger > 0 , "Search to Run if results Count is greater than 0","search to run if results count is not greater than 0, could be null()")
]

I solved with the above

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust
[ 
makeresults count=1 
| eval trigger= [ search index=myindexsource=*_done.txt _index_earliest=-1h@h _index_latest=-0h@h | head 1 | stats count  | return $count]
| eval search=if( trigger > 0 , "Search to Run if results Count is greater than 0","search to run if results count is not greater than 0, could be null()")
]

I solved with the above

0 Karma

jkat54
SplunkTrust
SplunkTrust

You can use this approach too:

| where trigger>0
| map search=“search to trigger”

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...