Splunk Search

when no events or any field contains contains zero for past hour through an alert

kirrusk
Communicator

Hi,

 

I'm trying to trigger an alert for the below scenarios (one alert).

scenario one: when there are no events, trigger alert.
Scenario two: When any of the fields contains (Zero) for the past hour.

DATE           FIELD1  FIELD2  FIELD3
2-8-2022   45             56           67
2-8-2022   54             67           87
2-8-2022    0              56           0
2-8-2022   543          56          676


Trigger an alert if (no events) are coming for any particular field or a field contains (Zero) in the past hour.

For example : the above table needs to trigger an alert by giving a table as result.

Labels (7)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @kirrusk,

you have to define a time range of calculation, e.g. every day and the run something like this:

index=your_index latest=-1h@h earliest=@h
| bin _time span=1h
| stats count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 BY _time
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @kirrusk,

you have to define a time range of calculation, e.g. every day and the run something like this:

index=your_index latest=-1h@h earliest=@h
| bin _time span=1h
| stats count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 BY _time
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0

Ciao.

Giuseppe

kirrusk
Communicator

@gcusello Thank you, it's working 
it's my bad not tell about query what I'm using.
I'm trying to use tstats 

So modified query like below

 

 

| tstats count WHERE index=your_index AND(TMPFIELD="FIELD1" OR TMPFIELD="FIELD2" OR TMPFIELD="FIELD3") GROUPBY index TMPFIELD _time latest=-1h@h earliest=@h
| timechart count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0

 

 

 

But problem is, it's giving zero in the table if data is present in the field also

EXAMPLE,
FIELD1    FIELD2   FIELD3
0                0               0

But in reality, field3 has values
FIELD1    FIELD2   FIELD3
0                0               59

so it should through alert as well, because FIELD1 & FIELD2 are Zero.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kirrusk,

tstats is always a good approach!

good for you, see next time, please accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...