Splunk Search

email alert for time period that contains multiple items

scr4tchfury
Engager

I want to send an email alert only when the last X minutes of a log contains "net1 down", "net2 down", "net3 down", and "net4 down". The messages are on different lines. How can I do this with the Splunk search app? Right now I have it send me an alert with results for "net* down" and eyeball it to make sure not all 4 are there.

Tags (2)
0 Karma
1 Solution

lukejadamec
Super Champion

Schedule a search to run every 15 minutes

Set the alert to trigger if the result count is greater than 3

index=yourindex sourcetype=yoursourcetype  yourfield="*net1 down*" OR  yourfield="*net2 down*" OR  yourfield="*net3 down*" OR  yourfield="*net4 down*"  | dedup yourfield

View solution in original post

lukejadamec
Super Champion

Schedule a search to run every 15 minutes

Set the alert to trigger if the result count is greater than 3

index=yourindex sourcetype=yoursourcetype  yourfield="*net1 down*" OR  yourfield="*net2 down*" OR  yourfield="*net3 down*" OR  yourfield="*net4 down*"  | dedup yourfield

lukejadamec
Super Champion

What is the field name that includes netxdown?

0 Karma

scr4tchfury
Engager

They are 4 different events.

0 Karma

lukejadamec
Super Champion

Are these different lines of the same event, or 4 different events?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...