Alerting

timechart, timewrap output alert

cbiraris
Path Finder

Hi Team,

I am looking for the help to get an alert trigger if the latest result of timechart command is 0.

Suppose i am running a search for last  8hrs with span=2hrs. so, if the result is something like below should raise an alert.

12-18-23 00:00 ---> is "0"

cbiraris_0-1702884682349.png

and also it should is display if there is "0" events in last 8hrs. as i am getting nothing, if no events during that time.



Thank you,

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @cbiraris,

adapt this sample to you use case:

| makeresults | eval _time=strptime("2023-12-18 02:01:01","%Y-%m-%d %H:%M:%S")
| append [ | makeresults | eval _time=strptime("2023-12-18 04:01:01","%Y-%m-%d %H:%M:%S") ]
| append [ | makeresults | eval _time=strptime("2023-12-18 06:01:01","%Y-%m-%d %H:%M:%S") ]
| timechart count span=1h
| eval col=strftime(_time,"%Y-%m-%d %H:%M:%S")." - ".count
| stats values(col) AS col latest(count) AS latest
| where latest=0

it shuld be something similar to this:

<your_search>
| timechart count span=1h
| eval col=strftime(_time,"%Y-%m-%d %H:%M:%S")." - ".count
| stats values(col) AS col latest(count) AS latest
| where latest=0

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @cbiraris,

you could simplify your alert running it every two hours using a simple search:

index=your_index earliest=-2h@h latest=@h

that fires if you haven't results.

Ciao.

Giuseppe

0 Karma

cbiraris
Path Finder

@gcusello Thank you for response 

I also want result of previous 8hrs with 2hrs interval to be displayed in alert result. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @cbiraris,

adapt this sample to you use case:

| makeresults | eval _time=strptime("2023-12-18 02:01:01","%Y-%m-%d %H:%M:%S")
| append [ | makeresults | eval _time=strptime("2023-12-18 04:01:01","%Y-%m-%d %H:%M:%S") ]
| append [ | makeresults | eval _time=strptime("2023-12-18 06:01:01","%Y-%m-%d %H:%M:%S") ]
| timechart count span=1h
| eval col=strftime(_time,"%Y-%m-%d %H:%M:%S")." - ".count
| stats values(col) AS col latest(count) AS latest
| where latest=0

it shuld be something similar to this:

<your_search>
| timechart count span=1h
| eval col=strftime(_time,"%Y-%m-%d %H:%M:%S")." - ".count
| stats values(col) AS col latest(count) AS latest
| where latest=0

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...