Trigger alert only if the result contain more than one host

[sjcoluccio67]

Hey Everyone,

I have an alert set up that triggers when any host has more than 100 events in 5 minutes. Here is the exact search:

index=msexchange recipient_status="451 4.3.2 *" | stats count by host | where count > 100

the results of this search only shows a host if its event count is > 100 and it shows the exact count for each host. I want to alter this alert to show the same results, but only trigger if there is more than one host. Is there a way to do this? I have tried embedding a stats command inside of another stats command but I have had no luck.

[memarshall63]

Does this work for you?

index=msexchange recipient_status="451 4.3.2 *"  | stats count by host | where count > 100
| eventstats dc(host) as Hostcount 
| where Hostcount > 1
| fields - Hostcount

This should display all hosts and their counts if the total number of hosts > 1. If the total number of hosts is < 2 -- then nothing displays.

[Vijeta]

@sjcoluccio67 You can keep your query as it is , and in the alert configuration -> Edit Alert -> Trigger Conditions->Trigger Alert when Number of Results >1

[sheamus69]

Have you tried something like:

 index=msexchange recipient_status="451 4.3.2 *" | stats dc(host) as host_count by host | where host_count > 1

You could also do some sort of combo like:

 index=msexchange recipient_status="451 4.3.2 *" | stats count dc(host) as host_count by host | where ( host_count > 1 AND count > 100 )

[sjcoluccio67]

I have tried this, but host_count will never be greater than one because it counts each host individually. Here is what the results look like:

host | count | host_count
| |

xxx01 | 107 | 1
xxx02 | 36 | 1
xxx07 | 57 | 1

[sjcoluccio67]

well, my formatting got messed up there^. I tried to make a table.

[lmonteith · Accepted solution]

When you save the search as an alert under trigger conditions you can select number of hosts for the "Trigger alert when" field and set it to is greater than 1.

[sheamus69]

Have you tried something like:

index=msexchange recipient_status="451 4.3.2 *" | stats dc(host) as host_count by host | where host_count > 1

You could also do some sort of combo like:

index=msexchange recipient_status="451 4.3.2 *" | stats count dc(host) as host_count by host | where ( host_count > 1 AND count > 100 )

Note: edited to fix a bug