Alerting

How to create a single alert for all HTTP error codes in events?

allurirohan
Explorer

Hi,

I would like to create a single alert for all HTTP error codes in events.
Ex: I would like to create an alert for 400,404,500 etc error codes if the count reaches 25 in 5 mins period for 2 error codes and if the count reaches 250 for other error code. Do I need to create an alert for each error code, or is there a way we can include everything in single alert?

Would really appreciate if anyone can help.

0 Karma

woodcock
Esteemed Legend

Like this (for a single alert/search):

... (errorCode=400 OR errorCode=404 OR errorCode=500) | bucket _time span=5 | stats count by errorCode _time | where (count<25 AND (errorCode=400 OR errorCode=404)) OR (count<250)
0 Karma

allurirohan
Explorer

Thank you for the quick response.
so , what trigger condition we need to select while creating the alert ?

0 Karma

woodcock
Esteemed Legend

Where Number of events and is greater than 0.

0 Karma

allurirohan
Explorer

Ok.One more question is , Is there a way to include the message in the alert description we which error code has exceeded the threshold?
Ex: we have the alert name as "Httperror alert" - but its just sending an alert with number of events (31).
So , we are not sure which error code exceeded,as we have 2 error codes has same threshold.

0 Karma

Richfez
SplunkTrust
SplunkTrust

In your "Save as Alert" dialog, in the "Send email" section, there are some options under "Include." Click the "Inline" option (4th one in that section) and leave the little drop-down next to it set to "table".

That will create a little table of the results of the search that triggered the alert, and include it in the email it sends, so you can see the data itself.

0 Karma

woodcock
Esteemed Legend

I am not sure what you mean here but perhaps this document will help:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Report/Schedulereports#Use_tokens_in_scheduled_rep...

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...