Splunk Search

How to trigger an alert when a metric is wrong on 3 consecutive spans?

FBachelin
Engager

Hi everyone, I have a search on approval success rates :

stats count as TOTAL,count(eval(criteria)) as APPROVED | eval APPROVEDPERCENT=if(TOTAL>0,round((APPROVED*100)/TOTAL,2),100)

I would then get the percentage of approved transactions on the time range.

I would like to raise an alert when this approvedpercent is less than 50 in 3 consecutive span of 15min.

I have tried the following based on another post:
| timechart span=15min max(APPROVEDPERCENT) as APPPERCENT | where APPPERCENT<50 | stats count as NumberNOK

(that I could run with the alert trigger condition as NumberNOK>=3 on last 45min)

But I ran this search on a time range where approval is 100% and NumberNOK is null . Anyone can help on this search?

thank you in advance

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| timechart span=15m count as TOTAL count(eval(criteria)) as APPROVED
| eval APPROVEDPERCENT=if(TOTAL>0,round((APPROVED*100)/TOTAL,2),100)
| where APPROVEDPERCENT < 50
| stats count as NumberNOK

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart span=15m count as TOTAL count(eval(criteria)) as APPROVED
| eval APPROVEDPERCENT=if(TOTAL>0,round((APPROVED*100)/TOTAL,2),100)
| where APPROVEDPERCENT < 50
| stats count as NumberNOK
0 Karma

FBachelin
Engager

Thank you so much, it is working . I just have now to trigger the alert if NumberNOK>=3. Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could add a where command

| where NumberNOK >= 3

Then trigger the alert if there are any rows

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...