Alerting

Alert help needed - Filtered events are still appearing

606866581
Path Finder

Hi,
I only want my alert to trigger if a particular field value has failed 2 or more times in the last 50 occurances. My current search is:

sourcetype=mySource ST_Script="myScript.py" ST_LogType="Step Log" | dedup 50 ST_Comment | search ST_Status=Fail | stats count AS FailuresInLast50 by ST_Comment | where FailuresInLast50 >= 2  

From the statistics tab this search appears to do what I wanted because only fields with 2 or more failures are appearing:

alt text

However when I go to create my alert condition (FailuresInLast50 count >= 2) I get an error because it can't parse my alert condition. I assume I'm going about this in slightly the wrong way, so some guidance would be much appreciated.
Thanks

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

You are trying to do the same thresh-holding work twice: once in your search and once in your alert trigger. You need to pick one place or the other. So let's keep your search exactly as it is. In this case, you need your alert Trigger condition to be Number of Results is Greater than 0. If you think about it, you will see what I mean but if not, just trust me and configure it this way and it will work.

View solution in original post

woodcock
Esteemed Legend

You are trying to do the same thresh-holding work twice: once in your search and once in your alert trigger. You need to pick one place or the other. So let's keep your search exactly as it is. In this case, you need your alert Trigger condition to be Number of Results is Greater than 0. If you think about it, you will see what I mean but if not, just trust me and configure it this way and it will work.

606866581
Path Finder

Thanks for your answer, I'll give it a go and report back!

0 Karma

the_wolverine
Champion

LOL. Sometimes that's how you have to explain it.

0 Karma

yannK
Splunk Employee
Splunk Employee

You asked all valued that are 2 or higher, therefore having events with where FailuresInLast50=2 is expected.
Are you sure tat all your values are not 2 ?
Can you run the same search without the "where" condition then see if you have values >2

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...