Splunk Search

Question on setting up the alerts

prettysunshinez
Explorer

I have a search query that outputs the count of the event for all the host (i.e., | stats count by host)

Now if the count is greater than 5,(for say host 1 and host 2 together gives more than 5 counts),an alert has to be triggered..

Let me know how..

TIA

@Anonymous 

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will fill the need.  Search for this:

| stats count by host 
| addcoltotals labelfield=host label=TOTAL count

   then have the alert trigger using the Custom setting:

search (host=TOTAL AND count > 5)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
| stats count by host
| stats sum(count) as count
| where count > 5
---
If this reply helps you, Karma would be appreciated.
0 Karma

prettysunshinez
Explorer

Thanks @richgalloway for the suggestion..

But what i would want is,to have host wise count in the alert mail..and the alert has to be triggered if the overall count is greater than 5

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will fill the need.  Search for this:

| stats count by host 
| addcoltotals labelfield=host label=TOTAL count

   then have the alert trigger using the Custom setting:

search (host=TOTAL AND count > 5)
---
If this reply helps you, Karma would be appreciated.
0 Karma

isoutamo
SplunkTrust
SplunkTrust

You could try this

| stats count by host
| streamstats sum(count) as total_count
| where total_count > 5

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...