How to create a single alert for all HTTP error codes in events?

[allurirohan]

Hi,

I would like to create a single alert for all HTTP error codes in events.
Ex: I would like to create an alert for 400,404,500 etc error codes if the count reaches 25 in 5 mins period for 2 error codes and if the count reaches 250 for other error code. Do I need to create an alert for each error code, or is there a way we can include everything in single alert?

Would really appreciate if anyone can help.

[woodcock]

Like this (for a single alert/search):

... (errorCode=400 OR errorCode=404 OR errorCode=500) | bucket _time span=5 | stats count by errorCode _time | where (count<25 AND (errorCode=400 OR errorCode=404)) OR (count<250)

[allurirohan]

Thank you for the quick response.
so , what trigger condition we need to select while creating the alert ?

[woodcock]

Where Number of events and is greater than 0.

[allurirohan]

Ok.One more question is , Is there a way to include the message in the alert description we which error code has exceeded the threshold?
Ex: we have the alert name as "Httperror alert" - but its just sending an alert with number of events (31).
So , we are not sure which error code exceeded,as we have 2 error codes has same threshold.

[Richfez]

In your "Save as Alert" dialog, in the "Send email" section, there are some options under "Include." Click the "Inline" option (4th one in that section) and leave the little drop-down next to it set to "table".

That will create a little table of the results of the search that triggered the alert, and include it in the email it sends, so you can see the data itself.

[woodcock]

I am not sure what you mean here but perhaps this document will help:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Report/Schedulereports#Use_tokens_in_scheduled_rep...