Alerting

Alert only when the count is continuously 0 for last 2 hours

ashrafsj
Path Finder

Hi all,

I have created a below SPL, which will alert when the RECEIVED =0, but I want this as an alert only when the last 2 hours continuously the RECEIVED=0, if there is data in span of 1 hour in time range of last 2 hours, I dont want to get an alert.

index=myIndex source=mySource sourcetype=mySourceType 
| timechart span=1h count AS Received 
| stats latest(Received) as RECEIVED by _time 
| where RECEIVED=0 

Please let me know how this can be achieved?

Tags (1)
0 Karma

to4kawa
Ultra Champion
| tstats count where index=myIndex source=mySource sourcetype=mySourceType by _time span=1h
| autoregress count as count_p
| where count==count_p AND count=0

If 2 hours count is 0, there is the event.

0 Karma

dindu
Contributor

Could you please try as below. Choose Trigger alert when number of results equal to zero

 index=myIndex source=mySource sourcetype=mySourceType  earliest=-2h@h latest=@h
| timechart span=1h count AS Received 
| stats sum(Received) as total_received
 |where total_received=0
0 Karma

to4kawa
Ultra Champion

I see, I fix a mistake. please confirm updated answer.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...