Splunk search query retrieves logs from the specified index, host, and sourcetype, filtering them based on various fields such as APPNAME, event, httpMethod, and loggerName. It then deduplicates the events based on the INTERFACE_NAME field and calculates the count of remaining unique events.
From our end records are processed successfully and we provide the condition to trigger an INC count less than 2
we are getting more than one successful events even alert get triggering and getting INC
Please check why we are getting false alert and suggest us
index=*core host=* sourcetype=app_log APPNAME=iSell event=requestActivity httpMethod=POST loggerName="c.a.i.p.a.a.a.StreamingActor" | dedup INTERFACE_NAME| stats count
Your final command will only give you one result event - depending on how you have set up the trigger for your alert, you could remove this and then trigger on the number of results being less than 2 i.e. let Splunk do the counting for you.