All Apps and Add-ons

How to trigger alerts on value of a custom field

joydeep741
Path Finder

My results are like :-

200 423405 757168 846810 OK

201 5704 15009 11408 HIGH COUNT

206 17 14 34 OK

301 20646 31255 41292 OK

302 11509 26836 23018 HIGH COUNT

I want to trigger the alert if the last column has even one occurrence value as "HIGH COUNT" ?Any suggestions

0 Karma

dineshraj9
Builder

Extract it into a field and then add a filter for the value -

index=A sourcetype=B | rex "(\w+\s+){4}(?<COUNT_STATUS>.+)" | search COUNT_STATUS="HIGH COUNT"

If the number of events returned for the query is more than 0 would be the condition.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!