Alerting

How to find out if we can trigger an alert if we are getting error continously for more than 5 mins?

mpr1985
New Member

We want to configure an alert where the if there are continuous errors for more than 5 mins per app server per host then we need to trigger that. By continuous we mean every min in those 5 mins we have some error. How can i check that every one min in those 5 mins there was error and then trigger the alert?

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

You can try something like this (it's untested)..

index=... log_level=ERROR
| bin _time span=1m
| stats count by _time
| where count>0
| makecontineous count

It is using 5 spans with 1 minute per span. Its then checking to see if each span has a count value then using makeconineous to see if there's 5 in a row

0 Karma

mpr1985
New Member

@skoelpin where are we specifying that it should be non-zero for 5 continuous bins in the query?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Correct, this is why I added | where count>0. I haven't tested this, but this will definitely get you started

0 Karma

mpr1985
New Member

This count is the for number of errors per min right? how to check if in last 5 spans all were > 0?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...