Alerting

alert report/search showing triggered devices

adrianrepublic
Explorer

We have alerts setup which trigger an email when a specific device has triggered. This has been working great and provided good alerting based on threshold below. 

The search is below:

index=index1 sourcetype="devices" earliest=-24h latest=now| stats avg(temp) as avg_temp by customer_id | where avg_temp < 15

However a customer wants reporting to show the individual customer/device and how many times it has alerted.Is there any way to report on this as the scheduler.log doesnt provide this granularity for say 3 months triggered alerts?

 

Labels (1)
Tags (2)
0 Karma

rnowitzki
Builder

Hi  @adrianrepublic 

You could add the alert action "Output results to lookup". So you have it in a table as long as you need it.
You can then create a report based on this lookup.

Hope it helps
BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma

adrianrepublic
Explorer

Hi @rnowitzki many thanks for this that could be a great option.

 

I will set this up and hopefully it produces a report. Would you suggest appending or replacing? I would like to be able to keep a certain amount overtime so appending would make more sense.

0 Karma

rnowitzki
Builder

Maybe append and also keep the timestamp. You could setup up another job that removes lines older than x months...

Cheers

--
Karma and/or Solution tagging appreciated.
0 Karma

adrianrepublic
Explorer

hi @rnowitzki  it seems to have produced the csv which is great.

 

However because the alert trigger is based on a value over an average over 24 hours and the scheduled alert runs everyday at 9am the timestamp how do i add the timestamp/date to the csv?

0 Karma

rnowitzki
Builder

Hi @adrianrepublic ,

You could add this at the end of your search, to get a column with today's date:

|eval today=strftime(now(), "%Y-%m-%d")

Or this, if you prefer epoch

|eval todayepoch=now()


The field should then be also created in the csv.

Hope that works for you.
BR
Ralph 

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...