Alerting

How to create Splunk single alert for multiple http status code?

vinothkumark
Path Finder

I have a field which contains http status code. I want to create a single alert query with multiple conditions. 

Example:
condition1) status code is 500 and greater than 10% alert should be triggered.
Condition 2) status code is 403 and greater than 20% alert should be triggered.
 
Condition 3) status code is 503 and greater than 20% alert should be triggered. 

Also, Is it possible to have different time range for the above condition? like condition 1 and condition 2 should search for last 15 minutes, whereas condition 3 should search for last 30 mins.

How do I form the query?

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vinothkumark ,

the condition on status codes and percentages is easy:

<your_search> status_code IN("500","403","503")
| stats
   count(eval(if(status_code="500",1,0))) AS 500_count
   count(eval(if(status_code="403",1,0))) AS 403_count
   count(eval(if(status_code="503",1,0))) AS 503_count
   count
| where 500_count/count>=0.1 OR 403_count/count>=0.2 OR 503_count/count>=0.2

the time condition can be easily added running two alerts or using a more complicated main search:

<your_search> ((status_code IN ("500","403") earliest=-15m) OR (status_code="503" earliest=-30m))
| stats
   count(eval(if(status_code="500",1,0))) AS 500_count
   count(eval(if(status_code="403",1,0))) AS 403_count
   count(eval(if(status_code="503",1,0))) AS 503_count
   count
| where 500_count/count>=0.1 OR 403_count/count>=0.2 OR 503_count/count>=0.2

Ciao.

Giuseppe

0 Karma

vinothkumark
Path Finder

It shows error in where command

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vinothkumark,

it should correctly run, please debug it using one by one the conditions.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...