All Apps and Add-ons

i want to create a alert on avg disk read/write latency

premranjithj
Builder

Below is the example for an event. below are the values available.i want to calculate avg value with span 30 secs and and if value crosses continuously 0.30 for more than 5 mins. the alert should trigger. the data will be available every 10 seconds

for time. we have _time

value disk_type counter drive
0.008749994761904096 PhysicalDisk Avg. Disk sec/Read G
0.008377771786948093 PhysicalDisk Avg. Disk sec/Read G:

0 Karma
1 Solution

inventsekar
Super Champion

try..

sourcetype="your source type" search phase | bucket _time span=30s | stats avg(value) as Average by _time | where Average > 0.3

on the alert creation GUI, you can mention, for 5 mins, then send the alert.

View solution in original post

0 Karma

inventsekar
Super Champion

try..

sourcetype="your source type" search phase | bucket _time span=30s | stats avg(value) as Average by _time | where Average > 0.3

on the alert creation GUI, you can mention, for 5 mins, then send the alert.

View solution in original post

0 Karma

premranjithj
Builder

i want to create alert if the threshold crosses for continuously for 5 mins not on single instance crossing threshold

0 Karma

inventsekar
Super Champion

that is what i said, in the alert creation window, you will have option, similar to this..
"Trigger when number of results: is greater than N".

https://docs.splunk.com/Documentation/Splunk/7.1.2/Alert/Alertexamples

0 Karma

premranjithj
Builder

if i am having time range for 4 hours. there may be multiple event crossing the threshold but it will not be continuously so how u ill set a condition here to trigger alert?

0 Karma

inventsekar
Super Champion

4hrs = 240 mins = 14400 seconds.
14400/30=480

4hrs will be 480 times 30 seconds.
so, if 480 times Avg is above 0.3, trigger an alert.

0 Karma

premranjithj
Builder

understanding is wrong. consider data between 1Am t0 4AM

if the first instance crossing threshold at 1.05 AM and i want to check other events crossing the continoulsy till 1.10 AM. if in between there is not event crossed the threshold i dont want to create an alert.
and another event crossing threshold at 2.12 AM if continoulsy crossing threshold till 2.17AM i want to trigger alert.

i dont care the event crossing at 2.10 and 3.10 and 3.50 at single instance crossing more than 5 event.

0 Karma

inventsekar
Super Champion

ya, i got it...it is possible... currently i am not having access to splunk (alert window)..
you have to adjust that span=30s and the alert trigger time..

you can create a simple alert, for one min, if the avg crossed 0.03, then create an alert..
if it works fine, then you can fine-tune it as per your needs.

(if your query got resolved, can you please accept this as the answer.. you can upvote this answer and comments as well 😉 )

0 Karma

inventsekar
Super Champion

Hi Prem.. may we know if this issue got resolved.. are you able to create the alert?!?!
if so, can you please mart this answer as "Accepted Answer", so that this post will move from unanswered to answered.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!