Hi Experts,
I need to create a alert , if HTTPCode_Target_5XX_Count is greater than 5% of Total count then i need to send alert mail.
My SPL
sourcetype=aws:cloudwatch
| spath path=Average
| spath path=Maximum
| spath path=Minimum
| spath path=SampleCount
| spath path=Sum
| spath path=Unit
| spath path=account_id
| spath path=metric_dimensions
| spath path=metric_name
| spath path=period
| spath path=timestampe
| search metric_dimensions="*app/adj-tok-nonprod-web-in-alb/*" AND metric_name=HTTPCode_Target* | stats sum(SampleCount) by metric_name |rename sum(SampleCount) as SampleCount | addtotals row=f col=t labelfield=metric_name SampleCount
Output Format:
metric_name SampleCount
HTTPCode_Target_2XX_Count 14684
HTTPCode_Target_3XX_Count 9551
HTTPCode_Target_4XX_Count 189
HTTPCode_Target_5XX_Count 44
Total 24468
Suggest what i need to append in my SPL to get proper result
Like this:
index="YouShouldAlwaySpecifyAnIndex" AND sourcetype="aws:cloudwatch"
| spath path=Average
| spath path=Maximum
| spath path=Minimum
| spath path=SampleCount
| spath path=Sum
| spath path=Unit
| spath path=account_id
| spath path=metric_dimensions
| spath path=metric_name
| spath path=period
| spath path=timestampe
| search metric_dimensions="*app/adj-tok-nonprod-web-in-alb/*" AND metric_name=HTTPCode_Target*
| stats sum(SampleCount) AS SampleCount BY metric_name
| eventstats sum(SampleCount) AS GrandTotal
| eval pct = 100 * (SampleCount / GrandTotal)
| where pct > 5
Like this:
index="YouShouldAlwaySpecifyAnIndex" AND sourcetype="aws:cloudwatch"
| spath path=Average
| spath path=Maximum
| spath path=Minimum
| spath path=SampleCount
| spath path=Sum
| spath path=Unit
| spath path=account_id
| spath path=metric_dimensions
| spath path=metric_name
| spath path=period
| spath path=timestampe
| search metric_dimensions="*app/adj-tok-nonprod-web-in-alb/*" AND metric_name=HTTPCode_Target*
| stats sum(SampleCount) AS SampleCount BY metric_name
| eventstats sum(SampleCount) AS GrandTotal
| eval pct = 100 * (SampleCount / GrandTotal)
| where pct > 5
P.S. Your subject stinks. Try harder next time.
I fixed it for you.
Try
sourcetype=aws:cloudwatch | spath path=Average
| spath path=Maximum
| spath path=Minimum
| spath path=SampleCount
| spath path=Sum
| spath path=Unit
| spath path=account_id
| spath path=metric_dimensions
| spath path=metric_name
| spath path=period
| spath path=timestampe
| search metric_dimensions="app/adj-tok-nonprod-web-in-alb/" AND metric_name=HTTPCode_Target*
| stats sum(SampleCount) as total,sum(eval(if(metric_name=="HTTPCode_Target_5XX_Count",SampleCount,0))) as 5xx
| eval perc=round((5xx/total)*100,2)
| where perc > 5