How do I trigger alert if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10?

[majilan1]

Hi,

I want the alert to trigger if there are extracts where TOTAL_PIECES >0 and RETRIEVAL_ATTEMPT= 10

Is there anybody can help with this please?

My search is,

index=A source=B sourcetype=c

| fillnull value=0 TOTAL_PIECES  RETRIEVAL_ATTEMPT

| where RETRIEVAL_ATTEMPT= 10

| rename "SASP_CTRL_SEQ_NBR" as "Extract_Seq_ID" ,"IV_STS" as "IV_Status", "RETRIEVAL_ATTEMPT" as "Retrieval_Attempt","PSTG_STMT_N" as "Pos_St","TOTAL_PIECES" as "Piece_Count"

| table "Extract_Seq_ID","IV_Status","Retrieval_Attempt","Pos_St","Piece_Count"

[gcusello]

Hi @majilan1,

if your search is correctly running, you have only to save it ("Save As")with the scheduling you need, what's the problem?

Ciao.

Giuseppe

[isoutamo · Accepted solution]

Hi

Just like @gcusello said. Use Save As after you have run your SPL query ( add  "AND TOTAL_PIECES > 0" to your where line). Then add Trigger Conditions when there are more than 0 results.

r. Ismo

[majilan1]

Thanks! It works, I forgot to add the second part of the condition: TOTAL_PIECES > 0.

[majilan1]

Alert should trigger if:

 There are any extracts where TOTAL_PIECES is >0 and the RETRIEVAL_ATTEMPT is = 10.

I added AND TOTAL_PIECES > 0, but I'm not getting no result. The thing  is when I move that TOTAL_PIECES is >0  I get some data, but I need to trigger based on the condition above.

Thanks

[gcusello]

Hi @majilan1.

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[majilan1]

Thanks, you guys have been a great helping solve these problems.