Alerting

How to create search query for an alert that triggers if a particular event occurs twice but not for rest of the events

simran_sharma
New Member

Hi Team, 

Can you suggest what should be search query of an alert that would trigger an alert only if a particular event say 'a' occurs twice. But for rest of the events it triggers and alert even if there is one single event.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Count the number of times events occur by whatever field contains what you are looking for with the stats command, then filter on whether the count is 2 (or greater?) and use this as the base for your alert.

0 Karma

simran_sharma
New Member

Thank you @ITWhisperer but this will trigger alert for all types event. But I want if  "*null_error*" is logged twice or more than twice in logs then only it triggers the alert. For rest of the events alert should get triggered even if there is a single event of it. Is this possible in single alert?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Count for each error type then filter where count > 1 OR error != "*null_error*"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...