Splunk Search

when no events or any field contains contains zero for past hour through an alert

kirrusk
Communicator

Hi,

 

I'm trying to trigger an alert for the below scenarios (one alert).

scenario one: when there are no events, trigger alert.
Scenario two: When any of the fields contains (Zero) for the past hour.

DATE           FIELD1  FIELD2  FIELD3
2-8-2022   45             56           67
2-8-2022   54             67           87
2-8-2022    0              56           0
2-8-2022   543          56          676


Trigger an alert if (no events) are coming for any particular field or a field contains (Zero) in the past hour.

For example : the above table needs to trigger an alert by giving a table as result.

Labels (7)
Tags (1)
0 Karma
1 Solution

gcusello
Legend

Hi @kirrusk,

you have to define a time range of calculation, e.g. every day and the run something like this:

index=your_index latest=-1h@h earliest=@h
| bin _time span=1h
| stats count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 BY _time
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @kirrusk,

you have to define a time range of calculation, e.g. every day and the run something like this:

index=your_index latest=-1h@h earliest=@h
| bin _time span=1h
| stats count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 BY _time
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0

Ciao.

Giuseppe

kirrusk
Communicator

@gcusello Thank you, it's working 
it's my bad not tell about query what I'm using.
I'm trying to use tstats 

So modified query like below

 

 

| tstats count WHERE index=your_index AND(TMPFIELD="FIELD1" OR TMPFIELD="FIELD2" OR TMPFIELD="FIELD3") GROUPBY index TMPFIELD _time latest=-1h@h earliest=@h
| timechart count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0

 

 

 

But problem is, it's giving zero in the table if data is present in the field also

EXAMPLE,
FIELD1    FIELD2   FIELD3
0                0               0

But in reality, field3 has values
FIELD1    FIELD2   FIELD3
0                0               59

so it should through alert as well, because FIELD1 & FIELD2 are Zero.

0 Karma

gcusello
Legend

Hi @kirrusk,

tstats is always a good approach!

good for you, see next time, please accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...