@niketnilay thank you for the detailed explanation. I don't need a .csv file with lookup OR dashboard, can you please help me out with simple search query with eval, and trigger the alert when search eventCount=0 in last 10 mins. if there is no way, I will go with the above solution because I am kind of beginner of Splunk tool 🙂 appreciate your help! ... View more

Thank you @Sukisen1981 ... View more

@p_gurav getting error: "Error in 'eval' command: The expression is malformed. Expected )" checked the query but didn't see anything is missing ... View more

sorry I am not an expert in Splunk and learning basic of it. Thank you. ... View more

@p_gurav Thank you. do I need to write eval in new line for each cluster? My requirement is actually something like below with base search query. | timechart partial=f span=15m count as current_count | streamstats window=10 current=f avg(current_count) as trend | eval cluster=case(host=my_host01* OR host=my_host02 OR host=my_host03*, "cluster1") | eval cluster=case(host=my_host04* OR host=my_host05* OR host=my_host06*, "cluster2") | eval cluster=case(host=my_host07* OR host=my_host08 OR host=my_host09, "cluster3") | eval trend=round(trend) | eval difference=current_count-trend | eval diff_percent=round((difference)/trend*100) | eval hr=strftime(_time, "%H") | table _time trend current_count difference diff_percent ... View more

Hi MuS, Got it, thank you 🙂 ... View more

Hi MuS, the query itself not returning means i is not giving any result: index=_audit action="alert_fired" | rename ss_name AS title | join title [ | rest /services/saved/searches | table title, alert_threshold ] | timechart values(alert_threshold) AS alert_threshold count by title though I can get the desired output by this: | rest /servicesNS/-/-/saved/searches splunk_server=local | search disabled=0 actions=* is_scheduled=1 so my request is simple I need to pull a report OR data where how many times an alert was triggered during a given time period, when it was triggered and whom the email was sent. I do have power user access on splunk but not an admin level. ... View more

Hi MuS , Yes, I am quite sure there must be a place where we capture the details of when the alert crossed the threshold value and an email was sent out. Using that value we can pull the data when this alert was triggered, how many times (let's say how many times in last 15 days) and whom the email notification was sent. I use below query for all the enabled alerts: | rest /servicesNS/-/-/saved/searches splunk_server=local | search disabled=0 actions=* is_scheduled=1 so using the above query can you please help me out here? ... View more

Hi gabarrygowin, Nope, that is not helpful. I f I need to see the details of the older alerts which were triggered, this won't help. ... View more

Hi MuS, I have same issue and looking for resolution. I followed the same query but it didn't work for me. Can you please help me out. FYI: I am using enterprise splunk, version 6.3.2 I was able to get the list of all the enabled alert from here: | rest /servicesNS/-/-/saved/searches But I need to get the details of how many times the alert was triggered in particular time duration, what was the alert and what time(when) ? Thank you! ... View more

Seems to be correct @cmerriman . Now I need the percentage value of both customerId's. Thank you! ... View more

Hi @cmerriman, Yes, if I take the above example it is working fine but when I add index, sourcetype, host and channelId the query is not working. so in your query you need the string: index=myapp sourcetype=log_source host="myhost" "Event*" AND "sell event" channelId=xyz so we just need to make it certain that anonymous customer percentage shouldn't be increasing on channelId=xyz. NOTE: customerId can have -1 value or any positive numeric value...and these numbers can be in thousands and millions so we need to make a percent comparison of known and unknown customers. In other words known(non -1) CUSTOMER_ID % should be at least 95%. Hope this helps. ... View more

Hi @cmerriman, Query is looking good but not getting desired output. Anonymous search percent is showing more than 80% which shouldn't be..most of the time it should be >=5%. customerId can have any values like 123456, 6546788, -1, 765478 out of these customerId's only those searches with customerId=-1 are anonymous search. Hope this help ! Please let me know if you need more details. Thank yoU! ... View more

Hi @niketnilay, I wrongly mentioned as customerID, correct value is customerId. I have corrected it and ran the query still not getting desired output. ... View more

Hi @rich7177 , Thanks a lot for your help, I have tried it in a different browser and I was able to see the results are coming fine. So, it seems to be a browser issue as you have already said...this issue is happening in Google Chrome browser only. Thank you once again ! 🙂 ... View more

Hi @rich77, I understand what you are explaining here and I appreciate the same, but I still having the same issue. The issue I am trying to raise here is, whatever I search for any time range...the result is showing a flat output under events tab. Lets take an example here with search string: host=myhost source="/var/log/xyz/health_etcd.log" sourcetype=var_log_xyz status=healthy | top limit=5 host so in this case if you look fr host it should be showing up and down bar as a result under event tab but in my case this is not happening and this is happening everytime. here is the url:![screenshot][1] http://imgur.com/4Mnnw8X ... View more

Here is the query string: index=app sourcetype=tc_jsp_ejb host="ejb" "main query string here" Still I am seeing the results in same way if I extend the time duration to 24 hrs ... View more

Thanks a lot @MuS, I got the details. Appreciated 🙂 ... View more

Hi @MuS, no help 😞 nothing is coming up..please help me if you can show me the results in a screenshot, would be very thankful to you. ... View more