Alerting

how to create a splunk alert for events services, events registration and events admin?

sreekala
New Member

I need to create the below alert:

• For all 3 endpoints (Events Services, Events Registration and Events Admin), check the error rate
o Trigger Condition –
 if error rate>5% it’s SL3,
 if error rate>15% it’s SL2
o Trigger Frequency – Check for every 30 mins for the duration of last 30 mins

Tags (2)
0 Karma

woodcock
Esteemed Legend

Your search only doesn't work because the 2nd "if" is encompassed in the 1st one so it never gets considered/triggered. Try this:

index=web environment=prdv sourcetype=access_combined_wcookie application=web-nonpci uri=/events-registration/* | stats count by error_rate | eval severity=case(error_rate>15, "SL2", error_rate >=5,"SL2", true(),"LOW") | table error_rate, severity

It always helps to post your existing search in the question. The problem you have has nothing to do with the question you asked and would never have gotten resolved without posting your search.

0 Karma

woodcock
Esteemed Legend

We really need to see your events but assuming you can translate my made-up things, this should work:

... | stats count(eval(searchmatch(error*))) AS errors count AS total by endpoint | eval error_rate = 100*error/total | where error_rate > 5

Then save this as a Major alert which is run every 30 minutes ( */30 * * * * ) for the last 30 minutes (from -30m@m to now). Create another one but change the 5 to 15 and make it Critical.

0 Karma

sreekala
New Member

Thankyou Woodcock,

But I want it a consolidated one. that is one single alert. I have created one here. But i guess there is some error, because I am unable to get the result.

index=web environment=prdv sourcetype=access_combined_wcookie application=web-nonpci uri=/events-registration/* | stats count by error_rate | eval severity=if(error_rate>=5, "SL1",if(error_rate >15,"SL2",LOW)) | table error_rate, severity

This is the one which I have created. Could you please check this out if there is something that you can help me out?

Thanks
Sreekala

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...