Reporting

Why my alert condition doesn't work?

philip_wong
Communicator

I'm creating an alert to notify me when license pool usage is over 90% of defined pool size.

Firstly, I wrote the alert search and condition like this. But I couldn't get anything when it's over 90%.

Search: index=_internal source=*license_usage.log type=Usage | eval used_gb=round(b/1024/1024/1024,2) | eval total_gb=poolsz/1024/1024/1024 | stats sum(used_gb) as used_gb first(total_gb) as total_gb by pool | eval percentage=round(used_gb/total_gb*100,2)
Condition: if custom condition is met "search percentage>=90"

After that, I change to this and it works!

Search: index=_internal source=*license_usage.log type=Usage | eval used_gb=round(b/1024/1024/1024,2) | eval total_gb=poolsz/1024/1024/1024 | stats sum(used_gb) as used_gb first(total_gb) as total_gb by pool | eval percentage=round(used_gb/total_gb*100,2) | where percentage>=90
Condition: if number of events larger than 0

Anyone can tell what's the difference?

Thanks!

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi philip.wong,

What version of Splunk are you using? Starting from Version 6.2 you can use the Distributed Management Console which has all kind of different alerts pre configured http://docs.splunk.com/Documentation/Splunk/latest/Admin/Platformalerts and it contains a license alert :

Total license usage near daily quota    
Fires when you have used 90% of your total daily license quota.

No need to re-invent the wheel 😉

btw, you should use where to compare two fields and their value and not to compare a field with a string, see this answer https://answers.splunk.com/answers/128739/difference-between-where-and-search-commands.html

Have you tested it with only percentage>=90 in the custom condition?

Hope that helps ...

cheers, MuS

philip_wong
Communicator

We can't omit search/where in custom condition. But you raised a good point "where" is for boolean comparasion.
I checked to where percentage >= 90, it works now!

We're still running 6.1.6. It's good to know Splunk has this come with 6.2!

Thanks!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...