Splunk Search

Alert if result two following days

tenorway
Path Finder

Hi !

I wan't to create an alert which triggers if number of results for a search are greater than 0 two following days.
I have tried using eval with two subsearches, but I can't make it work. Any ideas?

My search which doesn't include a check for the number of values, and returns the same value for hitsyesterday and hitstoday:

sourcetype="websphere:systemout" | eval hitcountyesterday=[search "Problem occured while storing credit card application" earliest="-48h" latest="-24h" | stats count As hitcountyesterday| rename hitcountyesterday as query] | eval hitcounttoday=[search "Problem occured while storing credit card application" earliest="-24h" | stats count As hitcounttoday| rename hitcounttoday as query]

Tags (3)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

One quick way is to add another "| stats count" at the end of that search and alert when count=2

View solution in original post

_d_
Splunk Employee
Splunk Employee

One quick way is to add another "| stats count" at the end of that search and alert when count=2

View solution in original post

tenorway
Path Finder

Maybe I'm a bit slow, or just new to splunk semantics, but I don't understand what you mean. Out of the first stats comes two numbers, yesterday and today. How will a new pipe to stats change that? Could you please modify the search with what you mean? By the way, many thanks for the assistance!

0 Karma

_d_
Splunk Employee
Splunk Employee

The first stats will produce two numbers (rows) only if there is something to report on for each of the 24hr periods. So, if there are no matching events for "yesterday" but some for "today" it will only list "today". Which means that when this search

 "Problem occured while storing credit card application" earliest=-48h | eval when=if(_time<relative_time(now(), "-24h"), "yesterday", "today") | stats count by when | stats count

returns "2" that indicates that the first stats returned non-zero for both "today" and "yesterday".

0 Karma

tenorway
Path Finder

Works like a charm! Thanks a bunch

0 Karma

tenorway
Path Finder

A bit easier than my attempt:) However, I will only trigger the alert if there are hits both yesterday and today. How can I achieve that with this search?

0 Karma

_d_
Splunk Employee
Splunk Employee

Try something like this:

"Problem occured while storing credit card application" earliest=-48h | eval when=if(_time<relative_time(now(), "-24h"), "yesterday", "today") | stats count by when

..and then alert on a specific number of "count", such as 0, or whatever your threshold is.

0 Karma