Hi,
I want the alert to trigger if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10
Is there anybody can help with this please?
My search is,
index=A source=B sourcetype=c
| fillnull value=0 TOTAL_PIECES RETRIEVAL_ATTEMPT
| where RETRIEVAL_ATTEMPT= 10
| rename "SASP_CTRL_SEQ_NBR" as "Extract_Seq_ID" ,"IV_STS" as "IV_Status", "RETRIEVAL_ATTEMPT" as "Retrieval_Attempt","PSTG_STMT_N" as "Pos_St","TOTAL_PIECES" as "Piece_Count"
| table "Extract_Seq_ID","IV_Status","Retrieval_Attempt","Pos_St","Piece_Count"
Hi
Just like @gcusello said. Use Save As after you have run your SPL query ( add "AND TOTAL_PIECES > 0" to your where line). Then add Trigger Conditions when there are more than 0 results.
r. Ismo
Hi @majilan1,
if your search is correctly running, you have only to save it ("Save As")with the scheduling you need, what's the problem?
Ciao.
Giuseppe
Hi
Just like @gcusello said. Use Save As after you have run your SPL query ( add "AND TOTAL_PIECES > 0" to your where line). Then add Trigger Conditions when there are more than 0 results.
r. Ismo
Thanks! It works, I forgot to add the second part of the condition: TOTAL_PIECES > 0.
Alert should trigger if:
There are any extracts where TOTAL_PIECES is >0 and the RETRIEVAL_ATTEMPT is = 10.
I added AND TOTAL_PIECES > 0, but I'm not getting no result. The thing is when I move that TOTAL_PIECES is >0 I get some data, but I need to trigger based on the condition above.
Thanks
Hi @majilan1.
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated by all the contributors 😉
Thanks, you guys have been a great helping solve these problems.