Splunk Search
Highlighted

Fire an alert when count of a particular value in one column is greater than something

Engager

Hello,
I have a query like so:
source=“some-source.log” MySearchQuery | stats count by user, host_name

which produces results like:

user         host_name      count
user1        host_name1      5
user2        host_name2      6
user1        host_name3      9
user3        host_name1      3
user3        host_name3      4 

My question is: how can I write a query to fire an alert when the sum of count for any user in the above table is greater than 10, e.g user1 here.

0 Karma
Highlighted

Re: Fire an alert when count of a particular value in one column is greater than something

SplunkTrust
SplunkTrust

Option 1:

source=“some-source.log” MySearchQuery 
| stats count by user, host_name
| eventstats sum(count) as total_user by user
| where total_user > 10

Then click on save as > alert

Option 2:

source=“some-source.log” MySearchQuery 
| stats count by user, host_name
| stats sum(count) as total_user, values(host_name) as host_name by user
| where total_user > 10

Then click on save as > alert

Hope that helps.

Regards,
J

View solution in original post

Highlighted

Re: Fire an alert when count of a particular value in one column is greater than something

Engager

Thanks, accepted the answer. Just another question related to the table in question. Is there a way to attach all of the users' list in the email? Currently, I am using $result.user$ which only picks up the first user.

0 Karma
Highlighted

Re: Fire an alert when count of a particular value in one column is greater than something

SplunkTrust
SplunkTrust

You should be able by triggering results only once instead of by result and also including an inline table in your email.

See pictures below and hope that helps.

alt text

alt text

0 Karma
Highlighted

Re: Fire an alert when count of a particular value in one column is greater than something

Engager

Works so well. Thanks.

0 Karma