Alerting

How to trigger a query when an alert is triggered

ashwinve1385
Explorer

My requirement is to get the rate of change of a certain parameter if its corresponding alert gets triggered.
To add more details, we have a log file that logs the backlog of database. Once the backlog crosses a certain threshold we trigger an alert, however it could be a false positive since the system may be undergoing maintenance and hence backlog grows.
So I want the alert to trigger another query that captures rate of growth over the last 'x' hours.
This will give more context about what is happening in the system.
How to achieve this in splunk? Please share your ideas

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Build the growth calculation into the alert search such that the alert is only triggered based on both the backlog and the growth

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...