how to create a splunk alert for events services, events registration and events admin?

[sreekala]

I need to create the below alert:

• For all 3 endpoints (Events Services, Events Registration and Events Admin), check the error rate
o Trigger Condition –
 if error rate>5% it’s SL3,
 if error rate>15% it’s SL2
o Trigger Frequency – Check for every 30 mins for the duration of last 30 mins

[woodcock]

Your search only doesn't work because the 2nd "if" is encompassed in the 1st one so it never gets considered/triggered. Try this:

index=web environment=prdv sourcetype=access_combined_wcookie application=web-nonpci uri=/events-registration/* | stats count by error_rate | eval severity=case(error_rate>15, "SL2", error_rate >=5,"SL2", true(),"LOW") | table error_rate, severity

It always helps to post your existing search in the question. The problem you have has nothing to do with the question you asked and would never have gotten resolved without posting your search.

[woodcock]

We really need to see your events but assuming you can translate my made-up things, this should work:

... | stats count(eval(searchmatch(error*))) AS errors count AS total by endpoint | eval error_rate = 100*error/total | where error_rate > 5

Then save this as a Major alert which is run every 30 minutes ( */30 * * * * ) for the last 30 minutes (from -30m@m to now). Create another one but change the 5 to 15 and make it Critical.

[sreekala]

Thankyou Woodcock,

But I want it a consolidated one. that is one single alert. I have created one here. But i guess there is some error, because I am unable to get the result.

index=web environment=prdv sourcetype=access_combined_wcookie application=web-nonpci uri=/events-registration/* | stats count by error_rate | eval severity=if(error_rate>=5, "SL1",if(error_rate >15,"SL2",LOW)) | table error_rate, severity

This is the one which I have created. Could you please check this out if there is something that you can help me out?

Thanks
Sreekala