Splunk query to check for error within 150 seconds range

[kirrusk]

Hi,

I need to configure an alert when there is an error.

Example: "error: file not able to found"  for an app 

(need to get alert, if more than two messages for same app within 120-150 secs)

is it possible to configure, Can anyone please suggest?

[gcusello · Accepted solution]

Hi @kirrusk,

You have to aggregate your data, something like this:

index=your_index "error: file not able to found" earliest=-120s latest=now
| stats count BY app
| where count>2

You can change the treeshold and the time period as you like.

Using this search you can configure an alert that fires when results are greater than 0 (because the treeshold is in the search.

Ciao.

Giuseppe

[gcusello]

hi @kirrusk,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated;-)