My goal is to design an alert that will populate a table of raw results, but only when certain evaluation aggregates apply. For example, if the total count of events in a time frame >100, post table ...
See more...
My goal is to design an alert that will populate a table of raw results, but only when certain evaluation aggregates apply. For example, if the total count of events in a time frame >100, post table of raw data. How do I achieve this limitation (similar to SQL "Having"), while reserving my desired table output?
My query so far, which reflects the table output I desire without the "Having" logic:
splunk_server=indexer* index=wsi sourcetype=fdpwsiperf (channel_type=ofx2 OR agent_service=OfxAgent) domain=tax
api_version=v1 capability=* tax_year=2019 partnerId!=*test* partnerId="ADP"
| lookup Provider_Alert.csv Provider_ID AS partnerId OUTPUT Tier Form_Type
| search Tier=Tier1
| eval capability=if(like(capability,"109%"),"1099",'capability')
| eval error_category=case(like(http_status_code_host,"5%"), "5XX", like(http_status_code_host,"4%"),"4XX", http_error_host="Read
timed out", 'http_error_host', 1==1, "Other")
| table _time, partnerId, intuit_tid, error_category, capability, tax_year, ofx_appid, host_base_url
| rename intuit_tid as TRNUID
Do not direct me to "From SQL to Splunk SPL" documentation. I've reviewed it, and it's not helpful for my use case.
Thanks!