How to create an alert email trigger based on percentage results in Splunk 5.0.2?

[PabloCarvalho]

Hello,

First of all, my Splunk version is "Splunk 5.0.2 build 149561"

I'm trying to create an alert based on the percentage of errors results. For example, if the error percentage is greater than or equal to 5%, I want to get an e-mail.

The search I'm using is:

MY SEARCH |WHERE id_cliente= "1" OR id_cliente= "2" | replace 1 with "CLIENT ONE" in id_cliente | replace 2 with "CLIENT TWO" in id_cliente | stats count as SENT, count(eval (type = "d")) as DELIVERY, count(eval (type = "b")) as BOUNCE by id_cliente, id_envio | eval PERCENT=round((BOUNCE*100)/SENT, 2) "%". | table id_cliente, id_envio, SENT, DELIVERY, BOUNCE, PERCENT | sort by -PERCENT

In "Manager >> Searches and reports" I tried the following configuration:

Alert
Condition >> if custom condition is met
Custom condition search >> "search PERCENT> = 5"

Please can you help me?

Thank you,

[Richfez]

PERCENT is being converted into a string (like "43.97%") when you append the percent sign in your eval statement. Leave the that of and let percent be a number ("43.97") and it should work.

MY SEARCH |WHERE id_cliente= "1" OR id_cliente= "2" | replace 1 with "CLIENT ONE" in id_cliente | replace 2 with "CLIENT TWO" in id_cliente | stats count as SENT, count(eval (type = "d")) as DELIVERY, count(eval (type = "b")) as BOUNCE by id_cliente, id_envio | eval PERCENT=round((BOUNCE*100)/SENT, 2) | table id_cliente, id_envio, SENT, DELIVERY, BOUNCE, PERCENT | sort by -PERCENT

And note I think there was a transcription typo in it: you have eval PERCENT=round((BOUNCE*100)/SENT, 2) "% ." but it should be eval PERCENT=round((BOUNCE*100)/SENT, 2)."%"

I also have to ask - why not upgrade to 6.3? There's a lot of new awesomeness in there.

[PabloCarvalho]

Hello, rich 7177!

We're working on update the Splunk version.

About the question, the query is OK, but unfortunately it doesn't work good. I guess that the alert configuration on "Searches and reports" wizard is wrong:

Condition is: "if custom condition is met"
Custom condition search: "search PERCENT=round((ERROS*100)/ENVIADOS,2) >= 5".

Thanks,