How to create a custom type of alert?


I want to create alert when for 5 consecutive minutes the threshold breaches 70% ?

The query I wrote is:

sourcetype="os" identity_operation="GetUser" minutesago= 1
| eval EndpointName = "Get User" | stats count by EndpointName
| eval message = case(count >= 1 * 1200,"100% alert",
count >= 0.9 * 1200,"90% alert",
count >= 0.8 * 1200,"80% warning",
count >= 0.7 * 1200,"70% warning")
Labels (3)
0 Karma

Esteemed Legend

Hi @amitrinx,

you have to insert an activation threshold, something like this:

sourcetype="os" identity_operation="GetUser" minutesago= 1
| rename "Get User" AS EndpointName
| stats count by EndpointName
| where count>= 0.7 * 1200
| eval message = case(count>=1*1200,"100% alert",
count>=0.9*1200,"90% alert",
count>=0.8*1200,"80% warning",
count>=0.7*1200,"70% warning")

otherwise, your alert is always triggered also for values less than your threshold.



0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...