Send Alert if # does not = 4

[taylormade2169]

What i am trying to do is send an alert if Alive_Iwalls does not equal 4. This will tell me if all of the firewalls are up and running. Any help would be greatly appreachiated.

sourcetype=SidewinderFirewall Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net | stats count by hostname | sort by count | stats count AS Alive_Iwalls | eval status = if(Alive_Iwalls == 4, "OK", "Error") | sendemail to="[email protected]" if(status== error) 

[dwaddle · Accepted solution]

What you need to do is pull part of your search into the alert condition of your alert. Use a search more like:

sourcetype=SidewinderFirewall 
Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net 
| stats count by hostname 

Then, when defining the scheduled search + alert, set an alert condition on "number of events" -> "does not equal" -> "4"

Then set the alert action to be the email, or any other action you need.

See docs at http://docs.splunk.com/Documentation/Splunk/5.0.2/Alert/Definescheduledalerts

[linu1988]

sourcetype=SidewinderFirewall Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net | stats count by hostname | sort by count | stats count AS Alive_Iwalls |Where Alive_Iwalls != 4

No conditions required anymore