Need help setting up the alerts

[theouhuios]

Hello

I am trying to set up an alert for search and I am not sure why it isn't working. Here is the search

sourcetype="incident"| rename record.assignmentGroup as A , record.affectedCI as B | eval mybucket=case(date_hour<4,1,date_hour<8,2,date_hour<12,3,date_hour<16,4,date_hour<20,5,date_hour>0,6) | stats count as I by B, mybucket,date_mday,date_month,date_year , A, _time |delta I as D | eval D = abs(D) | eventstats avg(I) as xbar, avg(D) as mbar by B | eval threshold = xbar + (2.66*mbar) | eval threshold=coalesce(threshold,0)|table B A I threshold

And the output will be like

    B         A     I   threshold

1 A0058A09 WG7100 1 1.00
2 A0058A09 WG7100 1 1.00
3 A0058A09 WG1675 1 1.00
4 A0058A09 WG1675 1 1.00
5 A0058A09 WG7100 1 1.00

Now I need to set up an alert where I>threshold. Any suggestions on what would be the method to set an alert for this.

Also is it possible to change the subject of alert to give the value of B and the threshold ? Like "Splunk Alert for $B$ with threshold as $threshold$". The subject will need to change according to the B which has crossed its threshold.

Any help?

Regards

theou

[sdaniels]

You should be able to add this onto the end of your search (remove the table command) and create an alert in the UI.

<yoursearch> | where I > threshold     
<yoursearch> | search I > threshold

Here is a simple example from our docs for setting up an alert given a threshold. http://docs.splunk.com/Documentation/Splunk/4.3.4/User/Alertusecases#Base_search_-_Refine_to_provide...

I don't think you can change the subject of the alerts currently but i'll check.

[theouhuios]

I did that now. There isn't much data in this environment. Will get back to you after I get few mails about how its working.

[sdaniels]

I just tried float versus int and that seems to be fine on determining greater than. What happens when you keep your search above with the table and you do 'If Custom condition is met' with 'search I > threshold'?

[theouhuios]

Thanks @sdaniels. I did the same when I tried it before. But I wonder why it was sending me emails even when I was equal to the threshold. Under the alerts there are 2 options "Once per search" and "Once per result". I had it setup for result. Would that have been the reason on why it sent me emails even when they are same? I was also wondering if the data would be reason as I would be "int" as 1,2 etc and threshold would be a "float" as 1.00,1.96 etc.

[theouhuios]

Any suggestions?