Splunk Search

How to set up an alert if Value1 > 0, a second alert if Value2 > Value1 + 5, and a third alert if Value3 > Value1 + 10?

manja054
Explorer

Data:
0:01:49 1
0:06:49 1
0:11:49 1
0:16:49 1
0:21:49 1
0:26:49 1
0:31:49 1
0:36:49 1

Logic to follow:
1) 1st alert when value in log is > 0 : host=* Sourcetype=* value1 > 0
2) 2nd alert when value in log increased by 5 from value in the 1st alert: host=* Sourcetype=* value2 > value1 + 5
3) 3rd alert when value exceeded original value +10: host=* Sourcetype=* value3 > value1 + 10
4) no alerts when value decreases: host=* Sourcetype=*

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

I think streamstats will work for what you need.

<search that generates the above results | 
streamstats window=2 last(value) as old_value first(value) as new_value | 
where new_value>old_value+5

You may need to flip the last/first values, or reverse the > sign, because my brain doesn't always remember those correctly.

Change the +5 in where new_value>old_value+5 for the different thresholds.

Once you have the list showing correctly for a particular test, create an alert for it. Repeat with different thresholds.

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

I think streamstats will work for what you need.

<search that generates the above results | 
streamstats window=2 last(value) as old_value first(value) as new_value | 
where new_value>old_value+5

You may need to flip the last/first values, or reverse the > sign, because my brain doesn't always remember those correctly.

Change the +5 in where new_value>old_value+5 for the different thresholds.

Once you have the list showing correctly for a particular test, create an alert for it. Repeat with different thresholds.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...