Splunk Search

Question on setting up the alerts

prettysunshinez
Explorer

I have a search query that outputs the count of the event for all the host (i.e., | stats count by host)

Now if the count is greater than 5,(for say host 1 and host 2 together gives more than 5 counts),an alert has to be triggered..

Let me know how..

TIA

@Anonymous 

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will fill the need.  Search for this:

| stats count by host 
| addcoltotals labelfield=host label=TOTAL count

   then have the alert trigger using the Custom setting:

search (host=TOTAL AND count > 5)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
| stats count by host
| stats sum(count) as count
| where count > 5
---
If this reply helps you, Karma would be appreciated.
0 Karma

prettysunshinez
Explorer

Thanks @richgalloway for the suggestion..

But what i would want is,to have host wise count in the alert mail..and the alert has to be triggered if the overall count is greater than 5

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will fill the need.  Search for this:

| stats count by host 
| addcoltotals labelfield=host label=TOTAL count

   then have the alert trigger using the Custom setting:

search (host=TOTAL AND count > 5)
---
If this reply helps you, Karma would be appreciated.
0 Karma

isoutamo
SplunkTrust
SplunkTrust

You could try this

| stats count by host
| streamstats sum(count) as total_count
| where total_count > 5

r. Ismo 

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...