Alerting

How to create an alert for missing value not present in result that its missing in given threshold time

varunawasthi9
New Member

How can we set an alert, if from a given list of values- 1 value is not present but in a span of 2 sec we get alert?

Eg:

index=abc complete ogid| if ogid is missing from list (abc, xyz)

xyz not received in 2-sec threshold get an alert that xyz didn't receive the orderid.

0 Karma

woodcock
Esteemed Legend

Like this:

index=abc complete ogid=*
| stats count BY ogid
| eval which="data"
| inputlookup append=t <lookup file with every ogid listed on a separate line only once, with only one field named 'ogid'>
| eval which=coalesce(which, "lookup")
| stats values(*) AS * dc(which) AS which_count BY ogid
| where which_count==1 AND which="lookup"
0 Karma

jitendragupta
Path Finder

You can try like below query. Run this in some cron schedule. If the number of results is greater than zero set an alert.

index=indexname earliest=-2s  | where ogid !=abc or ogid !=xyz
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...