I have a saved search, that starts with a dbquery | dbquery
, then does some transformations and ends with a collect
statement.
When I run this search manually, there are resulting events and all results go to the "Statistics" tab.
I want to monitor, if indeed data was collected by my saved search.
This does not do the trick:
counttype = number of events
quantity = 1
relation = less than
simply because there are no resulting events.
Is there a way to trigger an alert based on the number of rows in the "Statistics" tab?
When you run the Splunk Search that you want an alert for go to the top right and save as. There is an option for Save as Alert. The options include the count of the rows and lots of other options.
Here is an example:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Alertexamples
Passing events to the collect
command does not destroy the events so you can just tack this on to the end of your search and trigger off of count
:
... | stats count
If your search ends with collect - those results go somewhere else.
Can you write another search that queries the summary index over the appropriate time span to get your statistics?
Is there any way you could paste the search itself?
Which version of splunk you're using?
version 6.1.1