Splunk Search

retrieve host count depending on host value

marcosrios
Explorer

Hi, I'm trying to accomplish the following:
* alert when there is a host that has less than 2 occurences
* alert when the total count is less than 12

index=vts sourcetype=vtsr host=server* "Batch Processor is turned ON" | stats count(host) as hostCount by host | addcoltotals labelfield=host

host               hostCount
server 1           3
server 2           3
server 3           2
server 4           2
server 5           2
server 6           2
Total              14

How can I validate for each server and total count values just to specify when to trigger the alert?

Regards!

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

 index=vts sourcetype=vtsr host=server* "Batch Processor is turned ON" | stats count(host) as hostCount by host | eventstats sum(hostCount) as total | where hostCount<2 OR total<12

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

 index=vts sourcetype=vtsr host=server* "Batch Processor is turned ON" | stats count(host) as hostCount by host | eventstats sum(hostCount) as total | where hostCount<2 OR total<12
0 Karma

mlf
Path Finder

Just set a custom condition on the alert:

search (host!=Total AND hostCount<2) OR (host=Total AND hostCount<12)
0 Karma

woodcock
Esteemed Legend

Add this on:

... | eventstats count(eval(host!="Total" AND hostCount<2)) AS Trigger1 last(hostCount) AS Trigger2

Then trigger your alert on "Trigger1>0 AND Trigger2<12"

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...