Alerting

when splunk error count is more than a number

rajs115
Path Finder

Hi,

   I have a log file in splunk which reports the errors when ever something failed. Now i need to run a splunk query if a same error show up in Splunk more than 3 times in last 1 hour. If it happens i need to send an alert.

Can someone suggest me the query with time in it?

 

Thanks.

Labels (4)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Your "specification" can be interpreted in many ways 🙂

Do you just want to search for some alert and find out if it's 3 or more events? Or maybe you can have several different kinds of alerts and want to know if any single one of them occurs more than 3 times.

 

0 Karma

rajs115
Path Finder

@PickleRick ,

 

   "Build failed" is what i need to check in each event logs over the last 1 hour. If its repeated more than 3 times(from 3 events) in last 1 hour i need to send an alert. I hope you get my question now 🙂 

 

Thanks.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Just do your search for "Build Failed" and trigger the alert when number of results is greater than 2. Easy.

0 Karma

rajs115
Path Finder

sure @PickleRick . Thank you

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...