Splunk Search

Trigger alert after checking results for 3 minutes?

sarit_s
Communicator

Hello

How can I trigger an alert after checking the results for 3 minuets 
So for example, if I want that the alert will trigger if count>1 , I would like to check for 3 minutes if count>1 and only then raise the alert

How can i do it ?

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sarit_s ,

you have to schedule your alert every three minutes and insert a stats count and a threshold, so if you want to count the events where there's an error, you could schedule every three minutes an alert like this:

index=your_index error="your_error"
| stats count
| where count>1

then you have to configure your alert to trigger if results are greater than zero.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...