Alerting

Why is my savedsearches.conf configuration not honoring the alert condition of number of events > 10?

shreyasathavale
Communicator

I am creating an alert and configuring it in savedsearches.conf. The condition that i am giving is not firing the alert. It is firing whenever it finds the message, but my condition is "it should alert only if it is greater than 10" .. Below is savedsearch

counttype = number of events
quantity = 10
relation = greater than
alert_condition = | Where Message ="asdad"

My alert should fire if I have events more than 10, but even if the events are just 2 it is firing.. Any help?
I have removed alert_condition part now and checking if it works or not.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Check the definition of alert_condition from savedsearches.conf from Splunk Documentation

alert_condition = <search string>
* Contains a conditional search that is evaluated against the results of the saved search.
  Alerts are triggered if the specified search yields a non-empty search result list.
* **NOTE: If you specify an alert_condition, do not set counttype, relation, or quantity.**
* Defaults to an empty string.

See the NOTE. SInce you've mentioned alert_condition, the "number of events greater than 10" condition is not taking effect. Remove that.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Check the definition of alert_condition from savedsearches.conf from Splunk Documentation

alert_condition = <search string>
* Contains a conditional search that is evaluated against the results of the saved search.
  Alerts are triggered if the specified search yields a non-empty search result list.
* **NOTE: If you specify an alert_condition, do not set counttype, relation, or quantity.**
* Defaults to an empty string.

See the NOTE. SInce you've mentioned alert_condition, the "number of events greater than 10" condition is not taking effect. Remove that.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...