Alerting

How to set up a scheduled alert based on a matching field over a specific span of time?

thompsonsgg
New Member

Hello,
I would like to set up a scheduled alert that triggers when a field value is matching for 2 hours.

To give a further explanation, when our job runs long or stops running, one of the fields remains the same. This is okay as sometimes the jobs do run long and still complete, but if it runs over two hours it is something that needs to be looked into. Please find my attached search results. I would like to alert when the "ConfigVal" field displays the same timestamp for 2+ hours.

Does anyone know what my search criteria would be for this?

alt text

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your base search with time range earliest=-3h@h latest=@h | bucket span=1h _time | stats dc(_time) as NoOfHrs by ConfigVal | where NoOfHrs>2

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your base search with time range earliest=-3h@h latest=@h | bucket span=1h _time | stats dc(_time) as NoOfHrs by ConfigVal | where NoOfHrs>2

thompsonsgg
New Member

This worked, thanks!!

0 Karma

sundareshr
Legend

Try this

your base search | bin span=2h _time | eventstats dc(ConfigVal) as dcConfigVal by _time | where dcConfigVal=1
0 Karma

thompsonsgg
New Member

Thanks for your response Sundares, unfortunately it doesn't seem to work.

When using the bin span=2h _time portion of the search, I am not finding any results. When I take that portion out I do get results, but they are the same results as just looking at the log on it's own.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...