Splunk Search

when no events or any field contains contains zero for past hour through an alert

kirrusk
Communicator

Hi,

 

I'm trying to trigger an alert for the below scenarios (one alert).

scenario one: when there are no events, trigger alert.
Scenario two: When any of the fields contains (Zero) for the past hour.

DATE           FIELD1  FIELD2  FIELD3
2-8-2022   45             56           67
2-8-2022   54             67           87
2-8-2022    0              56           0
2-8-2022   543          56          676


Trigger an alert if (no events) are coming for any particular field or a field contains (Zero) in the past hour.

For example : the above table needs to trigger an alert by giving a table as result.

Labels (7)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @kirrusk,

you have to define a time range of calculation, e.g. every day and the run something like this:

index=your_index latest=-1h@h earliest=@h
| bin _time span=1h
| stats count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 BY _time
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @kirrusk,

you have to define a time range of calculation, e.g. every day and the run something like this:

index=your_index latest=-1h@h earliest=@h
| bin _time span=1h
| stats count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 BY _time
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0

Ciao.

Giuseppe

kirrusk
Communicator

@gcusello Thank you, it's working 
it's my bad not tell about query what I'm using.
I'm trying to use tstats 

So modified query like below

 

 

| tstats count WHERE index=your_index AND(TMPFIELD="FIELD1" OR TMPFIELD="FIELD2" OR TMPFIELD="FIELD3") GROUPBY index TMPFIELD _time latest=-1h@h earliest=@h
| timechart count(eval(FIELD1)) AS FIELD1 count(eval(FIELD2)) AS FIELD2 count(eval(FIELD3)) AS FIELD3 
| append [ index=_internal latest=-1h@h earliest=@h | head 1 | eval FIELD1=0, FIELD2=0, FIELD3=0| fields _time FIELD1 FIELD2 FIELD3 ]
| stats sum(FIELD1) AS FIELD1 sum(FIELD2) AS FIELD2 sum(FIELD3) AS FIELD3 BY _time
| where FIELD1=0 OR FIELD2=0 OR FIELD3=0

 

 

 

But problem is, it's giving zero in the table if data is present in the field also

EXAMPLE,
FIELD1    FIELD2   FIELD3
0                0               0

But in reality, field3 has values
FIELD1    FIELD2   FIELD3
0                0               59

so it should through alert as well, because FIELD1 & FIELD2 are Zero.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kirrusk,

tstats is always a good approach!

good for you, see next time, please accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...