Alerting

Splunk Alert query syntax

mike_k
Path Finder

I am just starting off with configuring up some Alerts in my Splunk environment.

One of the alerts that i have configured up as a test is to run a scheduled test once a day, looking to see whether any of the Cisco switches in my environment has restarted. I've configured up the following search:

index=<my_index> "%SYS-5-RESTART" | stats count

When using this as a simple search, this seems to work well, letting me know accurately if a switch has rebooted within the search time window. However with the alert that i have created from this search, it seems to be sending out an email regardless of the search result.

The Alert configuration i have used is as follows:

  • Alert Type: scheduled (run everyday at 5pm)
  • Expires 24 hours
  • Trigger alert when: Number of Results is greater than 0
  • Trigger: once
  • Trigger Actions: Send email

even today, when i used the above search term for the last 24 hours, it is coming up with a count of 0 and yet Splunk is still forwarding out an email at 5pm. Is there something that i am missing with the alert syntax?

Thanks,

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Your search is returning a result (count = 0) - add "| where count > 0" to your search so results are only returned when there is something worth alerting

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your search is returning a result (count = 0) - add "| where count > 0" to your search so results are only returned when there is something worth alerting

0 Karma

mike_k
Path Finder

thanks, that did the trick.

 

Tags (1)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>