Splunk Search

Create alert based on success rate per a group

MaratD
Explorer

Hi all,

I need to create an alert based on a success rate less than a specific value. My data is as follows:

store = "store1" result= "success"
store = "store1" result= "success"
store = "store1" result= "success-with-warnings"
store = "store1" result= "failed"

store = "store2" result= "success-with-warnings"
store = "store2" result= "failed"

store = "store3" result= "success-with-warnings"
store = "store3" result= "success"

I need to calculate the success rate based on each store. Result = "success" or "success-with-warnings" are considered a success, all other result values are considered failed. For example, using the above data, the search result should be something like this:

store1 %75 success
store2 %50 success
store3 %100 success

Then I need to use those values to create an alert, that will be triggered daily to check stores with a success rate is less than 70%. So in this case, I will get an alert for store2.

 

 

 

 

 

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Use something like this for your alert search

your search
| eventstats count as total by store
| eval success=if(result="success" OR result="success-with-warnings",1,0)
| stats sum(success) as successes values(total) as total by store
| eval success_rate=100*successes/total
| where success_rate < 70

Then set your alert to trigger if any rows are returned

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

This filter

 

| eval result = if(match(result, "^success"), "succeeded", "failure")
| stats count by store result
| eventstats sum(count) as subtotal by store
| eval percent = round(count / subtotal * 100) . "%"
| where result == "succeeded"
| table store percent result

 

gives something like

storepercentresult
store175%succeeded
store267%succeeded
store389%succeeded

 

Here, I used "succeeded" to illustrate that it is a combined count.  You can use any word.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use something like this for your alert search

your search
| eventstats count as total by store
| eval success=if(result="success" OR result="success-with-warnings",1,0)
| stats sum(success) as successes values(total) as total by store
| eval success_rate=100*successes/total
| where success_rate < 70

Then set your alert to trigger if any rows are returned

0 Karma

MaratD
Explorer

exactly what  I neee! thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...