Alerting

Custom Condition in Alert

pdash
Path Finder

I want to have a custom condition where am comparing two fields of my search. One returns the current day (%e) and the other returns date_mday. How do I write this condition because %e has a space before it. So should it be like this?

search currentday = " "+date_mday

How to concatenate the space or is there a way i can get the current day without that space or a zero

Tags (1)

pdash
Path Finder

Found the solution. So in this alert I wanted to compare date_mday with my Today field and trigger an alert when it happens today. Here goes the details

The query would be:
index=_internal source=*license_usage.log type=Usage | eval MB=b/1024/1024 | stats sum(MB) as TotalMBUsed by pool, date_mday|eval Today=trim((strftime(now(), "%e")), " ")| eval MBExceededBy = 512000 - TotalMBUsed |eval MBAvailable = 512000 |eval Environment = "DEV" |eval TriggeredOn = if((match(date_mday,Today)), "Today", date_mday)|where TotalMBUsed > 512000

Time Range is @mon to now

Custom Condtion is "search TriggeredOn = Today"

This would trigger the alert on the day a violation occurs and the alert table will have all the violation of that month so that you know how many violations you have done in this month.

pdash
Path Finder

Just found out in alert condition you need to use . to concatenate search currentday = " ".date_mday

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...