Alerting

How to create search query for an alert that triggers if a particular event occurs twice but not for rest of the events

simran_sharma
New Member

Hi Team, 

Can you suggest what should be search query of an alert that would trigger an alert only if a particular event say 'a' occurs twice. But for rest of the events it triggers and alert even if there is one single event.

Labels (1)
0 Karma

ITWhisperer
Ultra Champion

Count the number of times events occur by whatever field contains what you are looking for with the stats command, then filter on whether the count is 2 (or greater?) and use this as the base for your alert.

0 Karma

simran_sharma
New Member

Thank you @ITWhisperer but this will trigger alert for all types event. But I want if  "*null_error*" is logged twice or more than twice in logs then only it triggers the alert. For rest of the events alert should get triggered even if there is a single event of it. Is this possible in single alert?

0 Karma

ITWhisperer
Ultra Champion

Count for each error type then filter where count > 1 OR error != "*null_error*"

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!