Reporting

Trigger and send mail after 15th occurrence based on threshold breach

prsubramanian
New Member

Hi,
My requirement is : I have create real time schedule which will run for every 2 mins (cron schedule) based on the CPU Utilization crossed threshold value and mail should not trigger after 2 mins.
Mail has to trigger after 15th occurrence (ie after 15 * 2mins = 30 mins) if the threshold value crosses 98 %.

Please let me know how to check for the above condition to send mail after 15th occurrence if it cross threshold value.

Below is the query;
| table Host,"Process ID", "Instance"," % CPU Time" |sort " % CPU Time" desc | head 10
| eval "Alert Status" = case(('% CPU Time'<=manual_threshold3),"NORMAL", (' % CPU Time'>manual_threshold4),"CRITICAL", (' % CPU Time'>manual_threshold3 AND ' % CPU Time'<=manual_threshold4),"WARNING")
| search "Alert Status"="CRITICAL"
| table Host,"Process ID","Instance"," % CPU Time","Alert Status"

Thanks

0 Karma

woodcock
Esteemed Legend

Is this also you(r question)?
https://answers.splunk.com/answers/776314/how-to-send-alert-based-on-number-of-occurrences-b.html#an...

In any case, I have the same answer:
The way to do this is to write out the results of this search to a lookup file with ... | outputlookup. Then create another scheduled search that runs on a different cron schedule that mines the outputs of the first search using | inputlookup ... and applies your throttling/email logic. This second search (or even a third search) can trim/cleanup the lookup so that it doesn't grow out of control in size.

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...