Splunk Search

How to generate a search where the count is greater than 0 after 5 days?

nickyp86
Engager

I need to see if errors are still continuing after 5 days. If they are there then there is an issue and I need it to be displayed. I'm not sure how to show that. Please let me know if you need additional details.

0 Karma
1 Solution

mparks11
Path Finder

Probably need more details here, but you could do your base search for "errors" and have that run for the last 5 days, then pipe those results to stats and distinct count the days over which the errors existed, then trigger an alert if that distinct count >= 5.

index=foo sourcetype=bar "error" earliest=-5d | stats dc(date_wday) as days

Save As Alert then set a Trigger Condition for when days>=5.

Something like that maybe!

View solution in original post

mparks11
Path Finder

Probably need more details here, but you could do your base search for "errors" and have that run for the last 5 days, then pipe those results to stats and distinct count the days over which the errors existed, then trigger an alert if that distinct count >= 5.

index=foo sourcetype=bar "error" earliest=-5d | stats dc(date_wday) as days

Save As Alert then set a Trigger Condition for when days>=5.

Something like that maybe!

nickyp86
Engager

This is perfect. Thank you!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...