Installation

Two Questions From Newbie

rbtrary
Engager

1. How do I make my search string more readable?  It only works if it's all on one line.  I tried escaping new lines but splunk complains.

2. My query creates tables ok.  I want an alert to happen if one of the table entries is zero.   so I added.

blah blah | sort + "Appointments Processed" | where 'Appointments Processed' = 0

and "save as" an alert

but when it is zero, it doesnt send me email alert?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There's no need to highlight anything.  Just make sure the cursor is in the search box before typing CTRL-\.

I've had better results by putting my alert criteria in the search and having the alert trigger when the number of results is not zero.  IOW, make the last command of your search be 

| where Appointment Reminders = 0

and have the alert send email when results are returned.

Email settings are global.  They tell Splunk where your SMTP server is, among other things.  Without them there's no telling where emails go, if anywhere.

Logs are in index=_internal and in $SPLUNK_HOME/var/log on the SH.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

1. Click on your query and type Ctrl-\ to automatically reformat your query into a more readable form.  Do not use continuation characters or escapes to start a new line - just start a new line

2. Tell us more.  Does the search return results?  What is the alert trigger?  What is the alert action?  Is email configured on your Splunk SH?  Have you checked the logs?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

rbtrary
Engager

thank u Rich Galloway for the prompt reply

 

1. I hi-lite my search string in Edit Search and click Ctrl-\  everything is still on one line?

 

2. Yes search returns a table of results.

Alert trigger is "where Appointment Reminders = 0"

Alert action is to send an email.

email configured on splunk sh ? is that global?

where do we find the logs?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's no need to highlight anything.  Just make sure the cursor is in the search box before typing CTRL-\.

I've had better results by putting my alert criteria in the search and having the alert trigger when the number of results is not zero.  IOW, make the last command of your search be 

| where Appointment Reminders = 0

and have the alert send email when results are returned.

Email settings are global.  They tell Splunk where your SMTP server is, among other things.  Without them there's no telling where emails go, if anywhere.

Logs are in index=_internal and in $SPLUNK_HOME/var/log on the SH.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!