Splunk Search

How to trigger an alert when a metric is wrong on 3 consecutive spans?

FBachelin
Engager

Hi everyone, I have a search on approval success rates :

stats count as TOTAL,count(eval(criteria)) as APPROVED | eval APPROVEDPERCENT=if(TOTAL>0,round((APPROVED*100)/TOTAL,2),100)

I would then get the percentage of approved transactions on the time range.

I would like to raise an alert when this approvedpercent is less than 50 in 3 consecutive span of 15min.

I have tried the following based on another post:
| timechart span=15min max(APPROVEDPERCENT) as APPPERCENT | where APPPERCENT<50 | stats count as NumberNOK

(that I could run with the alert trigger condition as NumberNOK>=3 on last 45min)

But I ran this search on a time range where approval is 100% and NumberNOK is null . Anyone can help on this search?

thank you in advance

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| timechart span=15m count as TOTAL count(eval(criteria)) as APPROVED
| eval APPROVEDPERCENT=if(TOTAL>0,round((APPROVED*100)/TOTAL,2),100)
| where APPROVEDPERCENT < 50
| stats count as NumberNOK

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart span=15m count as TOTAL count(eval(criteria)) as APPROVED
| eval APPROVEDPERCENT=if(TOTAL>0,round((APPROVED*100)/TOTAL,2),100)
| where APPROVEDPERCENT < 50
| stats count as NumberNOK
0 Karma

FBachelin
Engager

Thank you so much, it is working . I just have now to trigger the alert if NumberNOK>=3. Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could add a where command

| where NumberNOK >= 3

Then trigger the alert if there are any rows

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...