Reporting

Why my alert condition doesn't work?

philip_wong
Communicator

I'm creating an alert to notify me when license pool usage is over 90% of defined pool size.

Firstly, I wrote the alert search and condition like this. But I couldn't get anything when it's over 90%.

Search: index=_internal source=*license_usage.log type=Usage | eval used_gb=round(b/1024/1024/1024,2) | eval total_gb=poolsz/1024/1024/1024 | stats sum(used_gb) as used_gb first(total_gb) as total_gb by pool | eval percentage=round(used_gb/total_gb*100,2)
Condition: if custom condition is met "search percentage>=90"

After that, I change to this and it works!

Search: index=_internal source=*license_usage.log type=Usage | eval used_gb=round(b/1024/1024/1024,2) | eval total_gb=poolsz/1024/1024/1024 | stats sum(used_gb) as used_gb first(total_gb) as total_gb by pool | eval percentage=round(used_gb/total_gb*100,2) | where percentage>=90
Condition: if number of events larger than 0

Anyone can tell what's the difference?

Thanks!

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi philip.wong,

What version of Splunk are you using? Starting from Version 6.2 you can use the Distributed Management Console which has all kind of different alerts pre configured http://docs.splunk.com/Documentation/Splunk/latest/Admin/Platformalerts and it contains a license alert :

Total license usage near daily quota    
Fires when you have used 90% of your total daily license quota.

No need to re-invent the wheel 😉

btw, you should use where to compare two fields and their value and not to compare a field with a string, see this answer https://answers.splunk.com/answers/128739/difference-between-where-and-search-commands.html

Have you tested it with only percentage>=90 in the custom condition?

Hope that helps ...

cheers, MuS

philip_wong
Communicator

We can't omit search/where in custom condition. But you raised a good point "where" is for boolean comparasion.
I checked to where percentage >= 90, it works now!

We're still running 6.1.6. It's good to know Splunk has this come with 6.2!

Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...