About jakeoftrades

jakeoftrades · ‎05-16-2022

Hi, Can anyone help me how can I change the field of my query to exclude those with PRODUCED labels query: index="hcg_ph_t2_bigdataservices_prod" sourcetype="be:streaming-services" earliest=-3h@h latest=@h | search stream_type IN (Datascore_Compress, Datascore_Decompress, Eservices_Eload, Eservices_Ebills) | eval service_details=stream_type." - ".kafka_datatype | bucket span=90m _time | stats sum(kafka_count) as count by _time service_details | stats latest(count) as current_count earliest(count) as past_count by service_details PRODUCED items which is under kafka_datatype: I have tried to add this to my query but still does not exclude those with PRODUCED: | sort .kafka_datatype asc | fields - "PRODUCED" Please help. Thank you, Jake

jakeoftrades · ‎05-05-2022

I think I should have change the number of results which is = 3 instead of 0 by the condition that it will only send alert.. it has been sending alert even without result.

jakeoftrades · ‎03-28-2022

Thank you @VatsalJagani I appreciate it !

jakeoftrades · ‎03-28-2022

Is this right .I did this:

jakeoftrades · ‎03-27-2022

I can't figure out where and how I should set the alert only to detect results specifically 7am-8pm in the trigger alert Time Range or should it be included in the query

jakeoftrades · ‎03-27-2022

hi, can anyone help me how should I query the counts of kafka_datatype of those stream_type which Im going to set an alert if there will be no increase within 3 hours within only a time period of time 7am-8pm I have this query : index="pcg_p4_datataservices_prod" sourcetype="be:monitoring-services" | setfields a=a | rex "^[^\|\n]*\|\s+(?P<kafka_datatype>\w+)\s+\-\s+(?P<kafka_count>.+)" | search kafka_datatype IN (PRODUCED, CONSUMED) | search stream_type IN (Datascore_Compress, Datascore_Decompress, Eservices_Eload, Eservices_Ebills) | eval service_details=stream_type | timechart span=3h limit=0 sum(kafka_count) by service_details I tried to add in the query for the earliest/latest (as -180m I guess for 3hrs) but not showing any result that Im aiming to set it to detect that if for 3 hours if no increase in the count of kafka_datatype of those stream_type which Im going to set the alert: index="pcg_p4_datataservices_prod" sourcetype="be:monitoring-services" earliest=-180m latest=now | setfields a=a | rex "^[^\|\n]*\|\s+(?P<kafka_datatype>\w+)\s+\-\s+(?P<kafka_count>.+)" | search kafka_datatype IN (PRODUCED, CONSUMED) | search stream_type IN (Datascore_Compress, Datascore_Decompress, Eservices_Eload, Eservices_Ebills) | eval service_details=stream_type | timechart span=3h limit=0 sum(kafka_count) by service_details

jakeoftrades · ‎03-27-2022

Thank you.. It shows the specific status that is STOPPED with it's count. By that then I can set the alert only to trigger for that status only between 7am-8pm ?

jakeoftrades · ‎03-27-2022

thanks it's showing the stat I needed to set alert

jakeoftrades · ‎03-23-2022

hi, will it also satisfy the condition if for 3 counts which will trigger the alert by this ? |where count<=03 I wonder in my case that I need to set a query that will trigger an alert which is (3 consecutive occurrence) in the logs within a specific time period like (7am-8pm) . what query should I add up. thanks

jakeoftrades · ‎03-23-2022

hi, Can someone help to correct the query provided below which will send alert if detected a STOPPED status for 3 consecutive times within a specific time range like for ex. from 7am-8pm. index="hcg_ph_t2_bigdataservices_prod" sourcetype="be:streaming-services" | search kafka_count="STOPPED" | stats count by _time,sourcetype,STOPPED | sort count desc | eval threshold=3 | where count >=threshold

Posts	10
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎03-23-2022

Online Status	Offline
Date Last Visited	‎06-30-2022 05:06 AM

How to Modify Field to exclude field not needed?

How to create a search to detect if no increase in...

How to write this Splunk Query for alert?

How to Modify Field to exclude field not needed?

Re: Splunk Query for alert

Re: Splunk Query for alert

Re: Splunk Query for alert

Re: Splunk Query for alert

How to create a search to detect if no increase in...

Re: Splunk Query for alert

Re: Splunk Query for alert

Re: How to create a search that will trigger an al...

How to write this Splunk Query for alert?