Alerting

HOw to setup alerts for 2 differnt condition in single saves search?

ashanka
Explorer

trying to setup an alert for certificate expiry. First alert will say, certificate will expire on 90 days. How to setup next alert when the expiry days = 60 days within the same alert?

ns=application_logs "Cert DN = CN=E3.certificate"

| table Number, DN,Date
| dedup Number, DN,Date
|eval dateDue=strptime('Date',"%a %b %d %H:%M:%S %Z %Y")
| eval days = round((dateDue-now())/86400)
| table Number, DN,Date,dateDue,days
| search days = 90

Here i have setup an alert when condition satisfies expiry days = 90. I need to setup a another alert when expiry days = 60.

First alert will be on when days = 90, next should be on days = 60

Tags (1)
0 Karma
1 Solution

niketn
Legend

@ashanka add both conditions in the same search filter with OR condition so that records are returned in either case for 90 days and 60 days.

<yourCurrentSearch>
| search days=90 OR days=60
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@ashanka add both conditions in the same search filter with OR condition so that records are returned in either case for 90 days and 60 days.

<yourCurrentSearch>
| search days=90 OR days=60
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ashanka
Explorer

yes it worked:) thanks

Shan
Builder

Dear @ashanka,

Try the below option.

| search days = 90 OR days = 60

Thanks ..

0 Karma

ashanka
Explorer

Thanks shankar, it worked

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...