Alerting

How to create Splunk single alert for multiple http status code?

vinothkumark
Path Finder

I have a field which contains http status code. I want to create a single alert query with multiple conditions. 

Example:
condition1) status code is 500 and greater than 10% alert should be triggered.
Condition 2) status code is 403 and greater than 20% alert should be triggered.
 
Condition 3) status code is 503 and greater than 20% alert should be triggered. 

Also, Is it possible to have different time range for the above condition? like condition 1 and condition 2 should search for last 15 minutes, whereas condition 3 should search for last 30 mins.

How do I form the query?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vinothkumark ,

the condition on status codes and percentages is easy:

<your_search> status_code IN("500","403","503")
| stats
   count(eval(if(status_code="500",1,0))) AS 500_count
   count(eval(if(status_code="403",1,0))) AS 403_count
   count(eval(if(status_code="503",1,0))) AS 503_count
   count
| where 500_count/count>=0.1 OR 403_count/count>=0.2 OR 503_count/count>=0.2

the time condition can be easily added running two alerts or using a more complicated main search:

<your_search> ((status_code IN ("500","403") earliest=-15m) OR (status_code="503" earliest=-30m))
| stats
   count(eval(if(status_code="500",1,0))) AS 500_count
   count(eval(if(status_code="403",1,0))) AS 403_count
   count(eval(if(status_code="503",1,0))) AS 503_count
   count
| where 500_count/count>=0.1 OR 403_count/count>=0.2 OR 503_count/count>=0.2

Ciao.

Giuseppe

0 Karma

vinothkumark
Path Finder

It shows error in where command

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vinothkumark,

it should correctly run, please debug it using one by one the conditions.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...