Alerting

How to write condition

yvreddy90
Engager

(index=logs OR index=audit) AND source="commtasks-logger" AND id=finishedcommtask |stats count by data.succeeded | transpose header_field="data.succeeded" | eval false perc = (f/(f+t))*100 | eval true perc = (t/(f+t))*100

This my query based on this how to write a condition is "false perc >10" trigger alert

Please help me anyone

Tags (1)

gcusello
SplunkTrust
SplunkTrust

Hi yvreddy90,
At first you should try your search putting attention to the field names (don't use spaces); false_perc.
Then you have to be sure that "f" and "t" fields have values, so you can calculate the false_perc field.

(index=logs OR index=audit) source="commtasks-logger" id=finishedcommtask 
| stats count by data.succeeded 
| transpose header_field="data.succeeded" 
| eval false_perc=(f/(f+t))*100

then, when you'll be sure of this, at the end of your search you can add the condition:

| where false_perc>10

So if you have results you can trigger the alert.

Bye.
Giuseppe

adonio
Ultra Champion

did you try ... | top data.succeeded instead of your ... | stats count ... ?

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...