Alerting

how to create a splunk alert for events services, events registration and events admin?

sreekala
New Member

I need to create the below alert:

• For all 3 endpoints (Events Services, Events Registration and Events Admin), check the error rate
o Trigger Condition –
 if error rate>5% it’s SL3,
 if error rate>15% it’s SL2
o Trigger Frequency – Check for every 30 mins for the duration of last 30 mins

Tags (2)
0 Karma

woodcock
Esteemed Legend

Your search only doesn't work because the 2nd "if" is encompassed in the 1st one so it never gets considered/triggered. Try this:

index=web environment=prdv sourcetype=access_combined_wcookie application=web-nonpci uri=/events-registration/* | stats count by error_rate | eval severity=case(error_rate>15, "SL2", error_rate >=5,"SL2", true(),"LOW") | table error_rate, severity

It always helps to post your existing search in the question. The problem you have has nothing to do with the question you asked and would never have gotten resolved without posting your search.

0 Karma

woodcock
Esteemed Legend

We really need to see your events but assuming you can translate my made-up things, this should work:

... | stats count(eval(searchmatch(error*))) AS errors count AS total by endpoint | eval error_rate = 100*error/total | where error_rate > 5

Then save this as a Major alert which is run every 30 minutes ( */30 * * * * ) for the last 30 minutes (from -30m@m to now). Create another one but change the 5 to 15 and make it Critical.

0 Karma

sreekala
New Member

Thankyou Woodcock,

But I want it a consolidated one. that is one single alert. I have created one here. But i guess there is some error, because I am unable to get the result.

index=web environment=prdv sourcetype=access_combined_wcookie application=web-nonpci uri=/events-registration/* | stats count by error_rate | eval severity=if(error_rate>=5, "SL1",if(error_rate >15,"SL2",LOW)) | table error_rate, severity

This is the one which I have created. Could you please check this out if there is something that you can help me out?

Thanks
Sreekala

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...