All Apps and Add-ons
Highlighted

i want to create a alert on avg disk read/write latency

Builder

Below is the example for an event. below are the values available.i want to calculate avg value with span 30 secs and and if value crosses continuously 0.30 for more than 5 mins. the alert should trigger. the data will be available every 10 seconds

for time. we have _time

value disk_type counter drive
0.008749994761904096 PhysicalDisk Avg. Disk sec/Read G
0.008377771786948093 PhysicalDisk Avg. Disk sec/Read G:

0 Karma
Highlighted

Re: i want to create a alert on avg disk read/write latency

Champion

try..

sourcetype="your source type" search phase | bucket _time span=30s | stats avg(value) as Average by _time | where Average > 0.3

on the alert creation GUI, you can mention, for 5 mins, then send the alert.

View solution in original post

0 Karma
Highlighted

Re: i want to create a alert on avg disk read/write latency

Builder

i want to create alert if the threshold crosses for continuously for 5 mins not on single instance crossing threshold

0 Karma
Highlighted

Re: i want to create a alert on avg disk read/write latency

Champion

that is what i said, in the alert creation window, you will have option, similar to this..
"Trigger when number of results: is greater than N".

https://docs.splunk.com/Documentation/Splunk/7.1.2/Alert/Alertexamples

0 Karma
Highlighted

Re: i want to create a alert on avg disk read/write latency

Builder

if i am having time range for 4 hours. there may be multiple event crossing the threshold but it will not be continuously so how u ill set a condition here to trigger alert?

0 Karma
Highlighted

Re: i want to create a alert on avg disk read/write latency

Champion

4hrs = 240 mins = 14400 seconds.
14400/30=480

4hrs will be 480 times 30 seconds.
so, if 480 times Avg is above 0.3, trigger an alert.

0 Karma
Highlighted

Re: i want to create a alert on avg disk read/write latency

Builder

understanding is wrong. consider data between 1Am t0 4AM

if the first instance crossing threshold at 1.05 AM and i want to check other events crossing the continoulsy till 1.10 AM. if in between there is not event crossed the threshold i dont want to create an alert.
and another event crossing threshold at 2.12 AM if continoulsy crossing threshold till 2.17AM i want to trigger alert.

i dont care the event crossing at 2.10 and 3.10 and 3.50 at single instance crossing more than 5 event.

0 Karma
Highlighted

Re: i want to create a alert on avg disk read/write latency

Champion

ya, i got it...it is possible... currently i am not having access to splunk (alert window)..
you have to adjust that span=30s and the alert trigger time..

you can create a simple alert, for one min, if the avg crossed 0.03, then create an alert..
if it works fine, then you can fine-tune it as per your needs.

(if your query got resolved, can you please accept this as the answer.. you can upvote this answer and comments as well 😉 )

0 Karma
Highlighted

Re: i want to create a alert on avg disk read/write latency

Champion

Hi Prem.. may we know if this issue got resolved.. are you able to create the alert?!?!
if so, can you please mart this answer as "Accepted Answer", so that this post will move from unanswered to answered.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.