Alert if result two following days

[tenorway]

Hi !

I wan't to create an alert which triggers if number of results for a search are greater than 0 two following days.
I have tried using eval with two subsearches, but I can't make it work. Any ideas?

My search which doesn't include a check for the number of values, and returns the same value for hitsyesterday and hitstoday:

sourcetype="websphere:systemout" | eval hitcountyesterday=[search "Problem occured while storing credit card application" earliest="-48h" latest="-24h" | stats count As hitcountyesterday| rename hitcountyesterday as query] | eval hitcounttoday=[search "Problem occured while storing credit card application" earliest="-24h" | stats count As hitcounttoday| rename hitcounttoday as query]

[_d_ · Accepted solution]

One quick way is to add another "| stats count" at the end of that search and alert when count=2

[tenorway]

Maybe I'm a bit slow, or just new to splunk semantics, but I don't understand what you mean. Out of the first stats comes two numbers, yesterday and today. How will a new pipe to stats change that? Could you please modify the search with what you mean? By the way, many thanks for the assistance!

[_d_]

The first stats will produce two numbers (rows) only if there is something to report on for each of the 24hr periods. So, if there are no matching events for "yesterday" but some for "today" it will only list "today". Which means that when this search

 "Problem occured while storing credit card application" earliest=-48h | eval when=if(_time<relative_time(now(), "-24h"), "yesterday", "today") | stats count by when | stats count

returns "2" that indicates that the first stats returned non-zero for both "today" and "yesterday".

[tenorway]

Works like a charm! Thanks a bunch

[tenorway]

A bit easier than my attempt:) However, I will only trigger the alert if there are hits both yesterday and today. How can I achieve that with this search?

[_d_]

Try something like this:

"Problem occured while storing credit card application" earliest=-48h | eval when=if(_time<relative_time(now(), "-24h"), "yesterday", "today") | stats count by when

..and then alert on a specific number of "count", such as 0, or whatever your threshold is.