Hi, I want to setup an alert on my search given below:- index="foo" source="/servers/logs/access.log" | rex "\"(?<ConsumerIP>[^\"]+)\"\s+(?<RequestTime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})\s(?<HttpMethod>[^\s]+)\s(?<EndpointURI>[^\s]+)\s(?<ResponseCode>\d+)\s(?<ServerInfo>[^\s]+)\s(?<GatewayIP>[^\s]+)\s(?<Ecid>[^\s]+)\s(?<ResponseTime>.+)" | stats count as TotalHits by EndpointURI Alert Settings:- Alert: DOH-PersonProfile Alert Description:Optional Alert type: Scheduled Run on Cron Schedule Time Range: Last 1 day Cron Expression: */5 * * * * Trigger Conditions Trigger alert when Custom search count>1000 Trigger: Once Trigger Actions When triggered Send emai To abc@company.com Priority: High Subject: Splunk Alert: $result.TotalHits$ Total number of requests received are : $requests.TotalHits$ Type: HTML & Plain Text Why is not the alert working? Could anyone help me with this? ... View more

Before asking the question, here is a brief description of what I have done and doing. Below query is working fine which returns the results as I need them:- index="test" | rex "\"(?[^\"]+)\"\s+(?\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})\s(?[^\s]+)\s(?[^\s]+)\s(?\d+)\s(?[^\s]+)\s(?[^\s]+)\s(?[^\s]+)\s(?.+)" | stats values(EndpointURI),count as TotalHits count(eval(ResponseCode!=200)) as ErrorCount max(eval(ResponseTime*1000)) as MaxResponseTime min(eval(ResponseTime*1000)) as MinResponseTime avg(eval(ResponseTime*1000)) as AvgRT by EndpointURI ConsumerIP | eval AvgRT=round(AvgRT,2) | rename AvgRT as AvgResponseTime | lookup ConsumerIPLookup ConsumerIP OUTPUT ConsumerName | lookup EndpointURILookup EndpointURI OUTPUT Provider,ServiceName,Version | streamstats count as "S.No" | fields S.No,Provider,ServiceName,Version,ConsumerName,TotalHits,ErrorCount,MaxResponseTime(ms),MinResponseTime(ms),AvgResponseTime(ms) Result of the above query:- 1 Provider1 Service1 1.0 Consumer1 3 1 572 220 396.67 2 Provider1 Service1 1.0 Consumer2 3 1 50 25 300.00 3 Provider1 Service1 1.0 Consumer2 7 4 100 50 200.00 4 Provider1 Service1 1.0 Consumer3 14 12 214 106 602.64 EndpointURILookup.csv contents:- EndpointURI,Provider,ServiceName,Version /abc/Provider1/Service1,Provider1,Service1,1.0 ConsumerIPLookup.csv Contents:- ConsumerIP,ConsumerName 10.10.10.1,Consumer1 10.10.10.2,Consumer2 10.10.10.3,Consumer2 10.10.10.4,Consumer3 What i need to know how can I modify/update the result of my query so that it returns the sum of Totalhits for those ConsumerNames who have multiple ConsumerIPs. For example, in ConsumerIPLookup.csv, Consumer 2 has multiple IP and Consumer Name is "Consumer2", I need to sum so that one record should come calculating TotalHits,ErrorCount,MaxResponseTime,,MinReponseTime,AvgResponseTime. The result should be like below:- 1 Provider1 Service1 1.0 Consumer1 3 1 572 220 396.67 2 Provider1 Service1 1.0 Consumer2 10 5 75 36 250.00 4 Provider1 Service1 1.0 Consumer3 14 12 214 106 602.64 How can i achieve this without losing any other stats? Is there any method to save csv lookup contents in a variable and use that variable to put condition and calculate the stats from my actual log? ... View more

Index 1 search result:- Provider IP Version Count Provider1 10.10.10.1 1.0 30 Provider1 10.10.10.2 1.0 40 Provider1 10.10.10.3 1.0 100 Provider2 10.10.10.2 1.0 50 Provider2 10.10.10.2 1.0 75 Provider2 10.10.10.6 1.0 81 Provider3 10.10.10.3 1.0 25 Provider3 10.10.10.3 1.0 92 Provider4 10.10.10.4 1.0 20 Index 2 search result:- <IPDetails> <Element1 Name="ABC"> <Service Version="1.0"> <Consumer EntityCode="Ent1"> <IP>10.10.10.1</IP> <IP>10.10.10.2</IP> <IP>10.10.10.3</IP> </Consumer> <Consumer EntityCode="Ent2"> <IP>10.10.10.4</IP> <IP>10.10.10.5</IP> </Consumer> </Service> </Element1> <Element2 Name="DEF"> <Service Version="1.0"> <Consumer EntityCode="Ent1"> <IP>10.10.10.1</IP> <IP>10.10.10.2</IP> <IP>10.10.10.3</IP> </Consumer> <Consumer EntityCode="Ent3"> <IP>10.10.10.6</IP> <IP>10.10.10.7</IP> <IP>10.10.10.8</IP> </Consumer> </Service> </API> </APIDetails> Could anyone advise me on how to replace the value of all IPs in IP field with second index's Consumer EntityCode, for example, "Ent1" should be replaced with 10.10.10.1 or 10.10.10.2 or 10.10.10.3, "Ent2" should be replaced with 10.10.10.4 or 10.10.10.5, "Ent3" should be replaced with 10.10.10.6 or 7 or 8? ... View more