My organization using something called Ticketer to in Splunk to auto-generate an incident form when something shows up in the logs. An example would look like this: ns="my_application_namespace" "Exception X has occurred" | eval severity="4" | eval emailAddress="myTeam@somewhere.com" | eval description = "Exception X has occured" | ticketer I saved that alert and it runs once an hour and if "Exception X has occurred" shows up in the logs anywhere an incident is created. Note that this isn't configured in the saved alert, it is part of the search query. Now, what want to do is run a search query for a healthcheck url to make sure a service is up and running. If I don't see the healthcheck url appearing in the logs for an hour it means the service is down and an incident needs to be created. This is what I have so far: ns="my_application_namespace" "healthcheckUrlHere" | eval severity="4" | eval emailAddress="myTeam@somewhere.com" | eval description = "The Servive is down" | ticketer I'm thinking I could use something like | stats count | search count=0 Would this work if I inserted it before the eval portion of the search? Like: ns="my_application_namespace" "healthcheckUrlHere" | stats count | search count=0 | eval severity="4" | eval emailAddress="myTeam@somewhere.com" | eval description = "The Servive is down" | ticketer Or is there a better way of doing something like this that I don't know about? Thanks for any help! ... View more

I have two searches something like this: "ns=my_project" message="*RESPONSE_CODE=200*" OR "*RESPONSE_CODE=400*" METHOD=API1 add|top RESPONSE_CODE "ns=my_project" message="*RESPONSE_CODE=200*" OR "*RESPONSE_CODE=400*" METHOD=API2 something_else|top RESPONSE_CODE I want to combine them into one graph/table that will look something like this: Any help or ideas are greatly appreciated! Thanks. ... View more