Alerting

What is the process for setting up an alert to trigger for >15 events in a 30 minute time?

CaptainHook
Communicator

Hello fellow Splunkers...I am currently work on a search that I need to alert on if it occurs greater than 15 times in a 30 minute period. I have set up the search/alerting, but I am a little lost on the best way to have the criteria inputted. Also, would it be best to set up a stats count, rather than using the alerts GUI? Any assistance would be appreciated.

Thank you.

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

try a search like :

<mysearchterms> | bucket _time span=30m | stats count by _time | where count > 15

it will return event count in 30 min bucket time, only if this count is higher than 15

the schedule to run on at least 30 minutes timerange

and put an alert trigger condition on : results > 0

View solution in original post

yannK
Splunk Employee
Splunk Employee

try a search like :

<mysearchterms> | bucket _time span=30m | stats count by _time | where count > 15

it will return event count in 30 min bucket time, only if this count is higher than 15

the schedule to run on at least 30 minutes timerange

and put an alert trigger condition on : results > 0

CaptainHook
Communicator

Thank you, that is exactly what I was hoping to find. Much appreciated.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

Elaboration: Check the timechart command http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart which means you can do:
<mysearchterms>
| timechart span=30min count
| where count > 15

Selfish Plug: Also, since you mentioned 15 times per 30min, I can't help but suggest my blog post on the topic: http://blogs.splunk.com/2016/01/29/writing-actionable-alerts/ In that post, I elaborate on how to have more adaptive thresholds rather than static.

0 Karma

CaptainHook
Communicator

Excellent! Thanks Burch, that is a great help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...