Alerting

how to create a splunk alert for events services, events registration and events admin?

sreekala
New Member

I need to create the below alert:

• For all 3 endpoints (Events Services, Events Registration and Events Admin), check the error rate
o Trigger Condition –
 if error rate>5% it’s SL3,
 if error rate>15% it’s SL2
o Trigger Frequency – Check for every 30 mins for the duration of last 30 mins

Tags (2)
0 Karma

woodcock
Esteemed Legend

Your search only doesn't work because the 2nd "if" is encompassed in the 1st one so it never gets considered/triggered. Try this:

index=web environment=prdv sourcetype=access_combined_wcookie application=web-nonpci uri=/events-registration/* | stats count by error_rate | eval severity=case(error_rate>15, "SL2", error_rate >=5,"SL2", true(),"LOW") | table error_rate, severity

It always helps to post your existing search in the question. The problem you have has nothing to do with the question you asked and would never have gotten resolved without posting your search.

0 Karma

woodcock
Esteemed Legend

We really need to see your events but assuming you can translate my made-up things, this should work:

... | stats count(eval(searchmatch(error*))) AS errors count AS total by endpoint | eval error_rate = 100*error/total | where error_rate > 5

Then save this as a Major alert which is run every 30 minutes ( */30 * * * * ) for the last 30 minutes (from -30m@m to now). Create another one but change the 5 to 15 and make it Critical.

0 Karma

sreekala
New Member

Thankyou Woodcock,

But I want it a consolidated one. that is one single alert. I have created one here. But i guess there is some error, because I am unable to get the result.

index=web environment=prdv sourcetype=access_combined_wcookie application=web-nonpci uri=/events-registration/* | stats count by error_rate | eval severity=if(error_rate>=5, "SL1",if(error_rate >15,"SL2",LOW)) | table error_rate, severity

This is the one which I have created. Could you please check this out if there is something that you can help me out?

Thanks
Sreekala

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...