Splunk Search

Fire an alert when count of a particular value in one column is greater than something

Vettori
Engager

Hello,
I have a query like so:
source=“some-source.log” MySearchQuery | stats count by user, host_name

which produces results like:

user         host_name      count
user1        host_name1      5
user2        host_name2      6
user1        host_name3      9
user3        host_name1      3
user3        host_name3      4 

My question is: how can I write a query to fire an alert when the sum of count for any user in the above table is greater than 10, e.g user1 here.

0 Karma
1 Solution

javiergn
Super Champion

Option 1:

source=“some-source.log” MySearchQuery 
| stats count by user, host_name
| eventstats sum(count) as total_user by user
| where total_user > 10

Then click on save as > alert

Option 2:

source=“some-source.log” MySearchQuery 
| stats count by user, host_name
| stats sum(count) as total_user, values(host_name) as host_name by user
| where total_user > 10

Then click on save as > alert

Hope that helps.

Regards,
J

View solution in original post

javiergn
Super Champion

Option 1:

source=“some-source.log” MySearchQuery 
| stats count by user, host_name
| eventstats sum(count) as total_user by user
| where total_user > 10

Then click on save as > alert

Option 2:

source=“some-source.log” MySearchQuery 
| stats count by user, host_name
| stats sum(count) as total_user, values(host_name) as host_name by user
| where total_user > 10

Then click on save as > alert

Hope that helps.

Regards,
J

Vettori
Engager

Works so well. Thanks.

0 Karma

Vettori
Engager

Thanks, accepted the answer. Just another question related to the table in question. Is there a way to attach all of the users' list in the email? Currently, I am using $result.user$ which only picks up the first user.

0 Karma

javiergn
Super Champion

You should be able by triggering results only once instead of by result and also including an inline table in your email.

See pictures below and hope that helps.

alt text

alt text

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...