Splunk Search

How to set up an alert if Value1 > 0, a second alert if Value2 > Value1 + 5, and a third alert if Value3 > Value1 + 10?

Explorer

Data:
0:01:49 1
0:06:49 1
0:11:49 1
0:16:49 1
0:21:49 1
0:26:49 1
0:31:49 1
0:36:49 1

Logic to follow:
1) 1st alert when value in log is > 0 : host=* Sourcetype=* value1 > 0
2) 2nd alert when value in log increased by 5 from value in the 1st alert: host=* Sourcetype=* value2 > value1 + 5
3) 3rd alert when value exceeded original value +10: host=* Sourcetype=* value3 > value1 + 10
4) no alerts when value decreases: host=* Sourcetype=*

0 Karma
1 Solution

SplunkTrust
SplunkTrust

I think streamstats will work for what you need.

<search that generates the above results | 
streamstats window=2 last(value) as old_value first(value) as new_value | 
where new_value>old_value+5

You may need to flip the last/first values, or reverse the > sign, because my brain doesn't always remember those correctly.

Change the +5 in where new_value>old_value+5 for the different thresholds.

Once you have the list showing correctly for a particular test, create an alert for it. Repeat with different thresholds.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

I think streamstats will work for what you need.

<search that generates the above results | 
streamstats window=2 last(value) as old_value first(value) as new_value | 
where new_value>old_value+5

You may need to flip the last/first values, or reverse the > sign, because my brain doesn't always remember those correctly.

Change the +5 in where new_value>old_value+5 for the different thresholds.

Once you have the list showing correctly for a particular test, create an alert for it. Repeat with different thresholds.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!