Splunk Enterprise

Why is alert not triggering as expected?

Vani_26
Path Finder

Hi, i got the below query, and alert should get triggered only when data is not avaiable from any one of the host_ips

i gave the time range as 24 hrs to now and alert condition = o and corn expression */30 * * * *

i am getting mail for every 30 mins, even if data is available.

index=advcf request=* host IN(abgc, efgh, jhty, hjyu,kjnb)
| eval event_ct=1
| append [| makeresults 
    | eval host="abgc, efgh, jhty, hjyu, kjnb"
    | rex field=host mode=sed "s/\s+//g"
    | eval host=split(host,",")
    | mvexpand host
    | eval event_ct=0
    ]
| stats sum(event_ct) AS event_ct BY host
| where event_ct=0

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The test for zero is already in the SPL

| where event_ct=0

so you want the alert to trigger when the SPL finds a zero count for a host.  Therefore, trigger when the number of results is not zero.

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

There doesn't appear to be anything wrong with your search - can you share your alert configuration?

0 Karma

Vani_26
Path Finder

alert configuration means, like what you want me to share.???

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Something like this

ITWhisperer_0-1667493763025.png

 

0 Karma

Vani_26
Path Finder

Vani_26_0-1667497496055.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I believe you want the alert to trigger is the number of results is NOT zero.  That is the error condition.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Vani_26
Path Finder


My requirement is that i should receive the mail when no data is available in the servers.
So my condition should be equal to 0 right???

Correct me if i am wrong.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The test for zero is already in the SPL

| where event_ct=0

so you want the alert to trigger when the SPL finds a zero count for a host.  Therefore, trigger when the number of results is not zero.

 

---
If this reply helps you, Karma would be appreciated.

Vani_26
Path Finder

thank you, it worked

0 Karma

Vani_26
Path Finder

So in the alert configuration, i need to mention number of results  "is not equal to 0"
Please confirm.

Vani_26_0-1667521765928.png

 

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...