Alerting

Why is my savedsearches.conf configuration not honoring the alert condition of number of events > 10?

shreyasathavale
Communicator

I am creating an alert and configuring it in savedsearches.conf. The condition that i am giving is not firing the alert. It is firing whenever it finds the message, but my condition is "it should alert only if it is greater than 10" .. Below is savedsearch

counttype = number of events
quantity = 10
relation = greater than
alert_condition = | Where Message ="asdad"

My alert should fire if I have events more than 10, but even if the events are just 2 it is firing.. Any help?
I have removed alert_condition part now and checking if it works or not.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Check the definition of alert_condition from savedsearches.conf from Splunk Documentation

alert_condition = <search string>
* Contains a conditional search that is evaluated against the results of the saved search.
  Alerts are triggered if the specified search yields a non-empty search result list.
* **NOTE: If you specify an alert_condition, do not set counttype, relation, or quantity.**
* Defaults to an empty string.

See the NOTE. SInce you've mentioned alert_condition, the "number of events greater than 10" condition is not taking effect. Remove that.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Check the definition of alert_condition from savedsearches.conf from Splunk Documentation

alert_condition = <search string>
* Contains a conditional search that is evaluated against the results of the saved search.
  Alerts are triggered if the specified search yields a non-empty search result list.
* **NOTE: If you specify an alert_condition, do not set counttype, relation, or quantity.**
* Defaults to an empty string.

See the NOTE. SInce you've mentioned alert_condition, the "number of events greater than 10" condition is not taking effect. Remove that.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...