Alerting

Alert based on number of events after charting the results

ilyashussain
Engager

I am a newbie on Splunk and have been trying to create an alert using the following search:

index=prodenvs source=prodlogs "transaction timeout"

I had setup it to cron every 5 mins and check past 5 mins and alert if the count goes more than 10. The alert was working fine but I wanted to summarize the results based on hosts.

index=prodenvs source=prodlogs "transaction timeout" | chart count by host

The alert stopped working after I changed it and I noticed that the alert criteria is taking number of hosts as the "count" now. Can I still use the alert feature based on the number of events and yet be able to chart my results? Any help is greatly appreciated.

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can set this as a custom alert condition:

stats sum(count) as sum | where sum > 10
0 Karma

strive
Influencer

Now you can set the alert using sum(count)

we will be able to provide clear answer if you can give us some more details

0 Karma

strive
Influencer

Where did you set the alerts? Is it on splunk web OR some custom script OR ?
Can you provide some more details

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...