Alerting

alert triggering thought no result is found when using a query

ksharma7
Path Finder

I have a very basic query. I want to trigger alert when count =0.

Using a very basic query like :

index=rxc sourcetype=rxcapp earliest=-1h@h latest=@h|stats count(eval(Code=200) as Success|fillnull value=0| table Success | where Success=0

If I am using this query in my splunk no result is returned to me as there were more than 0 success in past one hour. But when I put it on git and want my self alerted only in case if in last one hour count is 0 then it is triggering alert even though there are more than 0 counts in last one hour. Do not know what is wrong with this.

Used query the below way also but still same problem:

index=rxc sourcetype=rxcapp earliest=-1h@h latest=@h|stats count(eval(Code=200)) as Success| eval SuccessCount=0| eval pram = if((Count=0),"yes","no")|where pram="yes"|table SuccessCount

No idea why this simple query is creating problem , can anyone help me with this,

objective is very simple , to alert when count =0 in past one hour. I know this is very basic but cannot find the problem here.

using something like below in github:

enableSched = 1
cron_schedule = 8 */1 * * *
alert.suppress = 0
alert.suppress.period = 15
realtime_schedule = 1
counttype = number of events
action.email.inline = 1
action.email.sendresults = 1
action.email.to = xx
action.email.subject = xx
action.email.maxresults = 999
dispatch.earliest_time=-1h@h
dispatch.latest_time=@h
quantity = 0
relation = greater than
search = index=rxc sourcetype=rxcapp earliest=-1h@h latest=@h|stats count(eval(Code=200) as Success|fillnull value=0| table Success | where Success=0

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The problem is you're searching for something that is not there, which Splunk can't do. I suggest you remove the |where Success=0 command and have your alert trigger when the number of results is zero.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ksharma7
Path Finder

@richgalloway I understand that this query is wrong in terms I'm searching for something which is not there and know correct solution too. But the question is still there in my mind that why alert is triggering when I have events every hour where code is 200

0 Karma

ksharma7
Path Finder

editing the second way I am using query:

index=rxc sourcetype=rxcapp earliest=-1h@h latest=@h|stats count(eval(Code=200)) as Success| eval SuccessCount=0| eval pram = if((Success=0),"yes","no")|where pram="yes"|table SuccessCount

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...