Alerting

What is the process for setting up an alert to trigger for >15 events in a 30 minute time?

Communicator

Hello fellow Splunkers...I am currently work on a search that I need to alert on if it occurs greater than 15 times in a 30 minute period. I have set up the search/alerting, but I am a little lost on the best way to have the criteria inputted. Also, would it be best to set up a stats count, rather than using the alerts GUI? Any assistance would be appreciated.

Thank you.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

try a search like :

<mysearchterms> | bucket _time span=30m | stats count by _time | where count > 15

it will return event count in 30 min bucket time, only if this count is higher than 15

the schedule to run on at least 30 minutes timerange

and put an alert trigger condition on : results > 0

View solution in original post

Splunk Employee
Splunk Employee

try a search like :

<mysearchterms> | bucket _time span=30m | stats count by _time | where count > 15

it will return event count in 30 min bucket time, only if this count is higher than 15

the schedule to run on at least 30 minutes timerange

and put an alert trigger condition on : results > 0

View solution in original post

Communicator

Thank you, that is exactly what I was hoping to find. Much appreciated.

0 Karma

Ultra Champion

Elaboration: Check the timechart command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart which means you can do:
<mysearchterms>
| timechart span=30min count
| where count > 15

Selfish Plug: Also, since you mentioned 15 times per 30min, I can't help but suggest my blog post on the topic: http://blogs.splunk.com/2016/01/29/writing-actionable-alerts/ In that post, I elaborate on how to have more adaptive thresholds rather than static.

0 Karma

Communicator

Excellent! Thanks Burch, that is a great help.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!