Alerting

How to create Splunk single alert for multiple http status code?

vinothkumark
Explorer

I have a field which contains http status code. I want to create a single alert query with multiple conditions. 

Example:
condition1) status code is 500 and greater than 10% alert should be triggered.
Condition 2) status code is 403 and greater than 20% alert should be triggered.
 
Condition 3) status code is 503 and greater than 20% alert should be triggered. 

Also, Is it possible to have different time range for the above condition? like condition 1 and condition 2 should search for last 15 minutes, whereas condition 3 should search for last 30 mins.

How do I form the query?

Labels (1)
0 Karma

gcusello
Esteemed Legend

Hi @vinothkumark ,

the condition on status codes and percentages is easy:

<your_search> status_code IN("500","403","503")
| stats
   count(eval(if(status_code="500",1,0))) AS 500_count
   count(eval(if(status_code="403",1,0))) AS 403_count
   count(eval(if(status_code="503",1,0))) AS 503_count
   count
| where 500_count/count>=0.1 OR 403_count/count>=0.2 OR 503_count/count>=0.2

the time condition can be easily added running two alerts or using a more complicated main search:

<your_search> ((status_code IN ("500","403") earliest=-15m) OR (status_code="503" earliest=-30m))
| stats
   count(eval(if(status_code="500",1,0))) AS 500_count
   count(eval(if(status_code="403",1,0))) AS 403_count
   count(eval(if(status_code="503",1,0))) AS 503_count
   count
| where 500_count/count>=0.1 OR 403_count/count>=0.2 OR 503_count/count>=0.2

Ciao.

Giuseppe

0 Karma

vinothkumark
Explorer

It shows error in where command

0 Karma

gcusello
Esteemed Legend

Hi @vinothkumark,

it should correctly run, please debug it using one by one the conditions.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...