Alerting

How to create a single alert for all HTTP error codes in events?

allurirohan
Explorer

Hi,

I would like to create a single alert for all HTTP error codes in events.
Ex: I would like to create an alert for 400,404,500 etc error codes if the count reaches 25 in 5 mins period for 2 error codes and if the count reaches 250 for other error code. Do I need to create an alert for each error code, or is there a way we can include everything in single alert?

Would really appreciate if anyone can help.

0 Karma

woodcock
Esteemed Legend

Like this (for a single alert/search):

... (errorCode=400 OR errorCode=404 OR errorCode=500) | bucket _time span=5 | stats count by errorCode _time | where (count<25 AND (errorCode=400 OR errorCode=404)) OR (count<250)
0 Karma

allurirohan
Explorer

Thank you for the quick response.
so , what trigger condition we need to select while creating the alert ?

0 Karma

woodcock
Esteemed Legend

Where Number of events and is greater than 0.

0 Karma

allurirohan
Explorer

Ok.One more question is , Is there a way to include the message in the alert description we which error code has exceeded the threshold?
Ex: we have the alert name as "Httperror alert" - but its just sending an alert with number of events (31).
So , we are not sure which error code exceeded,as we have 2 error codes has same threshold.

0 Karma

Richfez
SplunkTrust
SplunkTrust

In your "Save as Alert" dialog, in the "Send email" section, there are some options under "Include." Click the "Inline" option (4th one in that section) and leave the little drop-down next to it set to "table".

That will create a little table of the results of the search that triggered the alert, and include it in the email it sends, so you can see the data itself.

0 Karma

woodcock
Esteemed Legend

I am not sure what you mean here but perhaps this document will help:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Report/Schedulereports#Use_tokens_in_scheduled_rep...

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...