Alerting

Trigger alert only if the result contain more than one host

Explorer

Hey Everyone,

I have an alert set up that triggers when any host has more than 100 events in 5 minutes. Here is the exact search:

index=msexchange recipient_status="451 4.3.2 *" | stats count by host | where count > 100

the results of this search only shows a host if its event count is > 100 and it shows the exact count for each host. I want to alter this alert to show the same results, but only trigger if there is more than one host. Is there a way to do this? I have tried embedding a stats command inside of another stats command but I have had no luck.

0 Karma
1 Solution

Engager

When you save the search as an alert under trigger conditions you can select number of hosts for the "Trigger alert when" field and set it to is greater than 1.

View solution in original post

0 Karma

Communicator

Does this work for you?

index=msexchange recipient_status="451 4.3.2 *"  | stats count by host | where count > 100
| eventstats dc(host) as Hostcount 
| where Hostcount > 1
| fields - Hostcount

This should display all hosts and their counts if the total number of hosts > 1. If the total number of hosts is < 2 -- then nothing displays.

0 Karma

Influencer

@sjcoluccio67 You can keep your query as it is , and in the alert configuration -> Edit Alert -> Trigger Conditions->Trigger Alert when Number of Results >1

0 Karma

Communicator

Have you tried something like:

 index=msexchange recipient_status="451 4.3.2 *" | stats dc(host) as host_count by host | where host_count > 1

You could also do some sort of combo like:

 index=msexchange recipient_status="451 4.3.2 *" | stats count dc(host) as host_count by host | where ( host_count > 1 AND count > 100 )
0 Karma

Explorer

I have tried this, but host_count will never be greater than one because it counts each host individually. Here is what the results look like:

host | count | host_count
| |

xxx01 | 107 | 1
xxx02 | 36 | 1
xxx07 | 57 | 1

0 Karma

Explorer

well, my formatting got messed up there^. I tried to make a table.

0 Karma

Engager

When you save the search as an alert under trigger conditions you can select number of hosts for the "Trigger alert when" field and set it to is greater than 1.

View solution in original post

0 Karma

Communicator

Have you tried something like:

index=msexchange recipient_status="451 4.3.2 *" | stats dc(host) as host_count by host | where host_count > 1

You could also do some sort of combo like:

index=msexchange recipient_status="451 4.3.2 *" | stats count dc(host) as host_count by host | where ( host_count > 1 AND count > 100 )

Note: edited to fix a bug

0 Karma