Alerting

How to create search query for an alert that triggers if a particular event occurs twice but not for rest of the events

simran_sharma
New Member

Hi Team, 

Can you suggest what should be search query of an alert that would trigger an alert only if a particular event say 'a' occurs twice. But for rest of the events it triggers and alert even if there is one single event.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Count the number of times events occur by whatever field contains what you are looking for with the stats command, then filter on whether the count is 2 (or greater?) and use this as the base for your alert.

0 Karma

simran_sharma
New Member

Thank you @ITWhisperer but this will trigger alert for all types event. But I want if  "*null_error*" is logged twice or more than twice in logs then only it triggers the alert. For rest of the events alert should get triggered even if there is a single event of it. Is this possible in single alert?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Count for each error type then filter where count > 1 OR error != "*null_error*"

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...