when no events or any field contains contains zero for past hour through an alert

[kirrusk]

Hi,

I'm trying to trigger an alert for the below scenarios (one alert).

scenario one: when there are no events, trigger alert.
Scenario two: When any of the fields contains (Zero) for the past hour.

DATE           FIELD1  FIELD2  FIELD3
2-8-2022   45             56           67
2-8-2022   54             67           87
2-8-2022    0              56           0
2-8-2022   543          56          676


Trigger an alert if (no events) are coming for any particular field or a field contains (Zero) in the past hour.

For example : the above table needs to trigger an alert by giving a table as result.

[gcusello · Accepted solution]

Hi @kirrusk,

you have to define a time range of calculation, e.g. every day and the run something like this:

index=your_index latest=-1h@h earliest=@h
| bin _time span=1h
| stats count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 BY _time
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0

Ciao.

Giuseppe

[kirrusk]

@gcusello Thank you, it's working 
it's my bad not tell about query what I'm using.
I'm trying to use tstats 

So modified query like below

| tstats count WHERE index=your_index AND(TMPFIELD="FIELD1" OR TMPFIELD="FIELD2" OR TMPFIELD="FIELD3") GROUPBY index TMPFIELD _time latest=-1h@h earliest=@h
| timechart count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0

But problem is, it's giving zero in the table if data is present in the field also

EXAMPLE,
FIELD1    FIELD2   FIELD3
0                0               0

But in reality, field3 has values
FIELD1    FIELD2   FIELD3
0                0               59

so it should through alert as well, because FIELD1 & FIELD2 are Zero.

[gcusello]

Hi @kirrusk,

tstats is always a good approach!

good for you, see next time, please accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: karma Points are appreciated 😉