Alerting

alert

vinod_52791
Engager

HI
from the below query i will get calls count whose responseTime is morethan 10000 milliseconds

index="ab_cs" host="aw-lx0456.vint.ent" source="cb-ss-service"AND((RequestedURL ="/man/*/details" OR REQUESTED_URL="/man/*/contacts") OR (RequestedURL ="/contacts /*/details" OR REQUESTED_URL="/contacts/*/members"))AND (ResponseStatus OR HttpStatusCode)|sort -1 Timetaken | eval TimeTaken3=trim(replace(Timetaken, ",",""))| where TimeTaken3 >=10000 |stats count as ResponseOver10Sec

But here I want to send an alert when count of ResponseOver10Sec is more than 2% of total transaction

could you please suggest appropriate query??


Labels (1)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Something like this should work

index="ab_cs" host="aw-lx0456.vint.ent" source="cb-ss-service"AND((RequestedURL ="/man/*/details" OR REQUESTED_URL="/man/*/contacts") OR (RequestedURL ="/contacts /*/details" OR REQUESTED_URL="/contacts/*/members"))AND (ResponseStatus OR HttpStatusCode) 
| eval TimeTaken3=trim(replace(Timetaken, ",","")) 
| stats count as Total sum(eval(if(TimeTaken3>=10000,1,0))) as ResponseOver10Sec
| where (ResponseOver10Sec/Total)>.02

you don't need to use sort - that's just making your search slower.

If the responses over 10 seconds is > than 2% of the total of your urls searched for, then you will get a single result, otherwise you will get no results, so you can set up your alert accordingly

 

 

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Something like this should work

index="ab_cs" host="aw-lx0456.vint.ent" source="cb-ss-service"AND((RequestedURL ="/man/*/details" OR REQUESTED_URL="/man/*/contacts") OR (RequestedURL ="/contacts /*/details" OR REQUESTED_URL="/contacts/*/members"))AND (ResponseStatus OR HttpStatusCode) 
| eval TimeTaken3=trim(replace(Timetaken, ",","")) 
| stats count as Total sum(eval(if(TimeTaken3>=10000,1,0))) as ResponseOver10Sec
| where (ResponseOver10Sec/Total)>.02

you don't need to use sort - that's just making your search slower.

If the responses over 10 seconds is > than 2% of the total of your urls searched for, then you will get a single result, otherwise you will get no results, so you can set up your alert accordingly

 

 

0 Karma

vinod_52791
Engager

Hi @bowesmana 

Thanks and it worked.

0 Karma

vinod_52791
Engager

HI @bowesmana 

I am getting response below

vinod_52791_0-1638182493364.png

But i want to send an alert when this condition satisfies that means i need that count morethan 1

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...