Alerting

alert triggering thought no result is found when using a query

ksharma7
Path Finder

I have a very basic query. I want to trigger alert when count =0.

Using a very basic query like :

index=rxc sourcetype=rxcapp earliest=-1h@h latest=@h|stats count(eval(Code=200) as Success|fillnull value=0| table Success | where Success=0

If I am using this query in my splunk no result is returned to me as there were more than 0 success in past one hour. But when I put it on git and want my self alerted only in case if in last one hour count is 0 then it is triggering alert even though there are more than 0 counts in last one hour. Do not know what is wrong with this.

Used query the below way also but still same problem:

index=rxc sourcetype=rxcapp earliest=-1h@h latest=@h|stats count(eval(Code=200)) as Success| eval SuccessCount=0| eval pram = if((Count=0),"yes","no")|where pram="yes"|table SuccessCount

No idea why this simple query is creating problem , can anyone help me with this,

objective is very simple , to alert when count =0 in past one hour. I know this is very basic but cannot find the problem here.

using something like below in github:

enableSched = 1
cron_schedule = 8 */1 * * *
alert.suppress = 0
alert.suppress.period = 15
realtime_schedule = 1
counttype = number of events
action.email.inline = 1
action.email.sendresults = 1
action.email.to = xx
action.email.subject = xx
action.email.maxresults = 999
dispatch.earliest_time=-1h@h
dispatch.latest_time=@h
quantity = 0
relation = greater than
search = index=rxc sourcetype=rxcapp earliest=-1h@h latest=@h|stats count(eval(Code=200) as Success|fillnull value=0| table Success | where Success=0

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The problem is you're searching for something that is not there, which Splunk can't do. I suggest you remove the |where Success=0 command and have your alert trigger when the number of results is zero.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ksharma7
Path Finder

@richgalloway I understand that this query is wrong in terms I'm searching for something which is not there and know correct solution too. But the question is still there in my mind that why alert is triggering when I have events every hour where code is 200

0 Karma

ksharma7
Path Finder

editing the second way I am using query:

index=rxc sourcetype=rxcapp earliest=-1h@h latest=@h|stats count(eval(Code=200)) as Success| eval SuccessCount=0| eval pram = if((Success=0),"yes","no")|where pram="yes"|table SuccessCount

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...