Alerting

Alert only when the count is continuously 0 for last 2 hours

ashrafsj
Path Finder

Hi all,

I have created a below SPL, which will alert when the RECEIVED =0, but I want this as an alert only when the last 2 hours continuously the RECEIVED=0, if there is data in span of 1 hour in time range of last 2 hours, I dont want to get an alert.

index=myIndex source=mySource sourcetype=mySourceType 
| timechart span=1h count AS Received 
| stats latest(Received) as RECEIVED by _time 
| where RECEIVED=0 

Please let me know how this can be achieved?

Tags (1)
0 Karma

to4kawa
Ultra Champion
| tstats count where index=myIndex source=mySource sourcetype=mySourceType by _time span=1h
| autoregress count as count_p
| where count==count_p AND count=0

If 2 hours count is 0, there is the event.

0 Karma

dindu
Contributor

Could you please try as below. Choose Trigger alert when number of results equal to zero

 index=myIndex source=mySource sourcetype=mySourceType  earliest=-2h@h latest=@h
| timechart span=1h count AS Received 
| stats sum(Received) as total_received
 |where total_received=0
0 Karma

to4kawa
Ultra Champion

I see, I fix a mistake. please confirm updated answer.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...