Splunk send alert if event count reaches some value with server which has that value.

[sahil237888]

Hi,

I want to search for an event "failure" from multiple hosts, and want splunk to send alert if count of events is greater than some value , along with which server has crossed that value.

The server name with number of count should be in mail alert.

Please help.

[sitaramupadrast]

Validate that where condition should have the count of failure threshold and report threshold should be one.

[sitaramupadrast]

1. Navigate to the Search page in the Search and Reporting app.
2. Create a search.
3. Select Save As>Alert.
4. Enter a title and optional description.
5. Specify permissions.
6. Configure alert scheduling. There are two options for scheduling.
7. Configure trigger conditions.
8. (Optional) Configure a trigger throttling period.
9. Select one or more alert actions that should happen when the alert triggers.
10. Click Save

here is the docs page for related example: http://docs.splunk.com/Documentation/Splunk/7.1.1/Alert/Alertexamples
For more details on all different kinds of alerts and options go though alerting documentation
http://docs.splunk.com/Documentation/Splunk/7.1.1/Alert/Aboutalerts

[somesoni2]

Just setup an alert with search similar to this and when setting up the email alert action, include the search result, inline or as attachment.

index=foo sourcetype=bar "Your Failure Criteria"
| stats count by host | where count>YourThresholdValue

[mendesjo]

works perfect, what if you had multiple fields? So, a condition happens say 100 times, but must happen on 10 different hosts as well?

[sahil237888]

Thanks.
yes i have that.
But my requirement is that in the mail should have only that server which has met search criteria.
and no others.

Suppose I have three servers A,B,C. and only c has met condition, so in mail only c server should be there. Like C server has crossed the threshold.
and other should not be there in mail as they have not met the threshold limit.

[sitaramupadrast]

Hey validate that you have failure threshold at where and alert threshold is 1.