Getting Data In

Splunk is not generating alert for normal stats count output 7.0.0

ashikuma
Explorer

Splunk is not generating alert for normal stats count output 7.0.0.

index=my_index "Response code -401" | stats count - after that I am saving this as result and keeping TH when it's count is greater than 10 , I need alert, but it's not working , not triggering alert after breaching TH. all other conditions are configured properly.

Is this common issue with stats command that we can't have alert for any string count ?

Tags (1)
0 Karma

hijacob
Communicator

Hi,

please have a look at https://answers.splunk.com/answers/453071/my-alert-is-not-working-how-do-i-troubleshoot.html

I hope you ca solve your problem.

Greetings
Jacob

0 Karma

ashikuma
Explorer

My alert setting are same , but I just want to know by we are doing stats count for any string and scheduling that as alert, why that is not working .
When I do like index=my_index "Response code -401" | stats count by host - then it's working but I don't need count by host.

I have to set TH on overall (index=my_index "Response code -401" | stats count ) value when TH exceeds more than 10 or any value but not zero.

Please suggest..

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...