Getting Data In

Splunk is not generating alert for normal stats count output 7.0.0


Splunk is not generating alert for normal stats count output 7.0.0.

index=my_index "Response code -401" | stats count - after that I am saving this as result and keeping TH when it's count is greater than 10 , I need alert, but it's not working , not triggering alert after breaching TH. all other conditions are configured properly.

Is this common issue with stats command that we can't have alert for any string count ?

Tags (1)
0 Karma



please have a look at

I hope you ca solve your problem.


0 Karma


My alert setting are same , but I just want to know by we are doing stats count for any string and scheduling that as alert, why that is not working .
When I do like index=my_index "Response code -401" | stats count by host - then it's working but I don't need count by host.

I have to set TH on overall (index=my_index "Response code -401" | stats count ) value when TH exceeds more than 10 or any value but not zero.

Please suggest..

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...