Alerting

How to create a custom type of alert?

amitrinx
Explorer

Hi,
I want to create alert when for 5 consecutive minutes the threshold breaches 70% ?

The query I wrote is:

sourcetype="os" identity_operation="GetUser" minutesago= 1
| eval EndpointName = "Get User" | stats count by EndpointName
| eval message = case(count >= 1 * 1200,"100% alert",
count >= 0.9 * 1200,"90% alert",
count >= 0.8 * 1200,"80% warning",
count >= 0.7 * 1200,"70% warning")
Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @amitrinx,

you have to insert an activation threshold, something like this:

sourcetype="os" identity_operation="GetUser" minutesago= 1
| rename "Get User" AS EndpointName
| stats count by EndpointName
| where count>= 0.7 * 1200
| eval message = case(count>=1*1200,"100% alert",
count>=0.9*1200,"90% alert",
count>=0.8*1200,"80% warning",
count>=0.7*1200,"70% warning")

otherwise, your alert is always triggered also for values less than your threshold.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...