Splunk Search

Simple stats conditional for alert

mikeely
Path Finder

I've set up a simple search for flapping interfaces on our switches, looks like so:

 LINEPROTO-5-UPDOWN: Line protocol on Interface changed state to | stats count by host

What I'd like to do is get an alert using a conditional ... stats count by host > 5 in fifteen minutes or something like that. When I try this out it returns no data:

 LINEPROTO-5-UPDOWN: Line protocol on Interface changed state to | stats count by host > 5

How do I get from there to where I want to be?

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
LINEPROTO-5-UPDOWN: Line protocol on Interface changed state to | stats count by host | where count > 5

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee
LINEPROTO-5-UPDOWN: Line protocol on Interface changed state to | stats count by host | where count > 5

mikeely
Path Finder

One would think I could have tried that myself but I've apparently got too many hats on today to be any good at one thing. Thanks!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

sorry, should be count > 5, not host. editing to fix.

mikeely
Path Finder

It looks like it should work but still "No results found" which is strange, when I take out the where clause, there are a couple values above five.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...