How to create a custom type of alert?


I want to create alert when for 5 consecutive minutes the threshold breaches 70% ?

The query I wrote is:

sourcetype="os" identity_operation="GetUser" minutesago= 1
| eval EndpointName = "Get User" | stats count by EndpointName
| eval message = case(count >= 1 * 1200,"100% alert",
count >= 0.9 * 1200,"90% alert",
count >= 0.8 * 1200,"80% warning",
count >= 0.7 * 1200,"70% warning")
Labels (3)
0 Karma

Esteemed Legend

Hi @amitrinx,

you have to insert an activation threshold, something like this:

sourcetype="os" identity_operation="GetUser" minutesago= 1
| rename "Get User" AS EndpointName
| stats count by EndpointName
| where count>= 0.7 * 1200
| eval message = case(count>=1*1200,"100% alert",
count>=0.9*1200,"90% alert",
count>=0.8*1200,"80% warning",
count>=0.7*1200,"70% warning")

otherwise, your alert is always triggered also for values less than your threshold.



0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...