Splunk Search

How to edit my alert search to set a trigger condition based on field value?

guru865
Path Finder

Hi all,

I am working on a search which triggers when the total failures by users is greater than 10 in last 30min. My result should capture the failures for each user and also the total failures count.

My search | stats count by users | addtotals col=t labelfield=users    

The result of this search is

user1      3 
user2      1
user3      12
Total      16

How do I need to set up a trigger condition so that all the above values are captured and the alert should be triggered when Total>10

Thanks in advance

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (since we included the check in query itself, your alert condition should be 'if number of events is greater than 0'

My search | stats count by users | eventstats sum(count) as Total | where count>10
| appendpipe [| stats max(Total) as count | eval users="Total" ] | fields - Total

View solution in original post

0 Karma

jpolcari
Communicator

I think you would have an easier time just looking at the total count of events in the alert trigger action. If you create an alert and select:

Trigger alert when: Number of results
is greater than: 10

0 Karma

somesoni2
Revered Legend

Try like this (since we included the check in query itself, your alert condition should be 'if number of events is greater than 0'

My search | stats count by users | eventstats sum(count) as Total | where count>10
| appendpipe [| stats max(Total) as count | eval users="Total" ] | fields - Total

View solution in original post

0 Karma

guru865
Path Finder

That has worked. Thanks

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!