Splunk Search

How do I include time range fields, Cron Schedule, and Alert Condition in my search to validate my Splunk Alert?


Hello Everyone ,

We need to validate our teams Splunk Alerts are correct.
And that the Alert conditions thresholds are set correctly.

I have a search that is effective at looking over the last 30 days of results and counting them against the threshold and time range window.

But if I have an alert with a Cron schedule , then I need to create something more dynamic.

Current Search:

 |timechart span=15m count earliest= |search count<10  

We need this same search to be able to run the Cron parameters.

Time Range : Earliest -16m@m    Latest: -1m@m
Cron Schedule : */15 6-22 * * 1-5   
Alert Condition : if number of events is less than 10 

Any Ideas ?

0 Karma

Revered Legend

Give this a try. It will exclude the events based on your cron time filters (run for hours 6 to 22, mon to fri)

| eval Hour=strftime(_time,"%H") | eval Day=strftime(_time,"%w")  | where Hour>5 AND Hour<23 AND Day>0 AND Day<6  |timechart span=15m count earliest= |search count<10  
0 Karma

Revered Legend

If you're running a search every 15 minutes and processing 15 mins worth of data, then instead of using timechart, you could use simple stats. and change the alert condition to if number of event is greater than 0 (means fire alert if found any records where count<10.

| stats  count |search count<10

Time Range : Earliest -16m@m Latest: -1m@m
Cron Schedule : */15 6-22 * 1-5
Alert Condition : if number of events is greater than 0

0 Karma


Im sorry maybe I did not word my question the correct way.

What I want to do is run a search query in the search bar that includes all the parameter fields in the Splunk Alert.

So I need to add the cron time frame to my original search query .

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!