Alerting

Why is my savedsearches.conf configuration not honoring the alert condition of number of events > 10?

shreyasathavale
Communicator

I am creating an alert and configuring it in savedsearches.conf. The condition that i am giving is not firing the alert. It is firing whenever it finds the message, but my condition is "it should alert only if it is greater than 10" .. Below is savedsearch

counttype = number of events
quantity = 10
relation = greater than
alert_condition = | Where Message ="asdad"

My alert should fire if I have events more than 10, but even if the events are just 2 it is firing.. Any help?
I have removed alert_condition part now and checking if it works or not.

0 Karma
1 Solution

somesoni2
Revered Legend

Check the definition of alert_condition from savedsearches.conf from Splunk Documentation

alert_condition = <search string>
* Contains a conditional search that is evaluated against the results of the saved search.
  Alerts are triggered if the specified search yields a non-empty search result list.
* **NOTE: If you specify an alert_condition, do not set counttype, relation, or quantity.**
* Defaults to an empty string.

See the NOTE. SInce you've mentioned alert_condition, the "number of events greater than 10" condition is not taking effect. Remove that.

View solution in original post

somesoni2
Revered Legend

Check the definition of alert_condition from savedsearches.conf from Splunk Documentation

alert_condition = <search string>
* Contains a conditional search that is evaluated against the results of the saved search.
  Alerts are triggered if the specified search yields a non-empty search result list.
* **NOTE: If you specify an alert_condition, do not set counttype, relation, or quantity.**
* Defaults to an empty string.

See the NOTE. SInce you've mentioned alert_condition, the "number of events greater than 10" condition is not taking effect. Remove that.

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...