Splunk Search
Highlighted

How do I only run a search if another search generates results

Engager

I have 2 searches that are working but I would like to do the following. If search 1 generates a result, I would like to run search 2 and if the search count value of search 2 is over a 20, send an alert. Does anyone know if this is possible ?

search 1
| eval queuelength=mvindex(messagesready,0) | eval queue=mvindex(name,0) | bucket time span=1m | search queuelength > 1000 | stats count, avg(queuelength) as averagequeue_length by queue | search count>=10

Search 2
index=* source="gateway.backend.log" Connection timed-out | bucket_time span=30m | stats count by _time | search count>20

Tags (1)
Highlighted

Re: How do I only run a search if another search generates results

Legend

You could do this by setting up search 1 to run as an alert - where the alert triggered a script that ran search 2 - and then search 2 had an alert condition as well. While this approach will absolutely work, it may be more complex than you want to tackle.

You could also combine the two searches into one, but that would always execute both searches - I don't know how to make one search execute conditionally.

A couple of notes about your searches: first, the | bucket _time span=1m can be eliminated from the first search, as it doesn't have any effect. Second, unless you have set the source name, you probably want to search for source="*gateway.backend.log" (using a wildcard).

0 Karma