Splunk Search

How to generate a search to count the number of rows present and if it is less that a certain value to send an alert?

Nishant_007
New Member

Need a search to count number of rows present and if it is less that a certain value to send alert. Also, i want the list of rows in that same mail.

0 Karma

Sarmbrister
Path Finder

When you say "count number of rows present" do you mean the number of rows in a static table? If I'm understanding what you want is the count of rows in a table and the static table in an alert.

0 Karma

Nishant_007
New Member

let me explain my problem
Lets assume i have index = App
has one service called login for which i have 4 nodes as login_1,login_2,login_3 & login_4

index= App host = Login_* | stats count by host |addcoltotals

So, it returns
host Count
Login_1 123124
Login_2 342345
Login_3 34235423
Login_4 4235235
addcoltotal 4

So, I want to set an alert when it this addcoltotal is less than 4. Which means one of the node is not sending data. Also, i want show the details of the one's which are sending data. So, the concerned person know for which node that person has to check.

Can you help me with it ?

0 Karma

sundareshr
Legend

There's great documentation online on scheduling alerts. Here's one link to get you started. Once you have saved your search as an alert, set the trigger on count of events returned. Here you can specify your rule of less than n to trigger the alert

http://docs.splunk.com/Documentation/Splunk/6.5.0/Alert/Definescheduledalerts

*UPDATED*

index=App host=Login_* | eventstats dc(host) as nohosts | stats count max(nohosts) as hostcount by host
0 Karma

Nishant_007
New Member

Thanks for the input I know how to create alerts.

let me explain my problem
Lets assume i have index = App
has one service called login for which i have 4 nodes as login_1,login_2,login_3 & login_4

index= App host = Login_* | stats count by host |addcoltotals

So, it returns
host Count
Login_1 123124
Login_2 342345
Login_3 34235423
Login_4 4235235
addcoltotal 4

So, I want to set an alert when it this addcoltotal is less than 4. Which means one of the node is not sending data. Also, i want show the details of the one's which are sending data. So, the concerned person know for which node that person has to check.

Can you help me with it ?

0 Karma

sundareshr
Legend

Try the updated query. For trigger condition, use custom and `search hostcount<4'

0 Karma

Nishant_007
New Member

Thanks buddy,

I guess the query is working fine. But, I am not getting any alerts still.
Is there any way i can check whether the alert is getting triggered or not. coz i am not receiving in my mail box.

0 Karma

sundareshr
Legend

I would start by creating a very simple alert index=_internal sourcetype="splunkd" | head 1 set alert where search sourcetype="splunkd". If that works, this should work.

0 Karma

Nishant_007
New Member

Sundaresh r all the other alerts we have created are working fine.

Just this alert is not triggering

0 Karma

sundareshr
Legend

Then add this to the end of your query | where hostcount<4 and trigger alert on count>0

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@Nishant_007 - Did the answers provided by sundareshr help to resolve your question? If yes, please click on "Accept" to close out your post. Thank you!

0 Karma

Nishant_007
New Member

What updated Query??

0 Karma

Nishant_007
New Member

Oh i see it now... 😄 sorry was looking at the wrong place

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...