Splunk Search

Include results of another search in the body of an alert?

jtsplunk
Splunk Employee
Splunk Employee

I have an alert that fires when the hourly count is 50% greater hour over hour, this seems to be working fine:

index=foo_web APPLICATION="foo_web" CODE="abc123" errorCode!="null" earliest=-1h@h latest=@h | stats count as LastHour | appendcols [search index=foo_web APPLICATION="foo_web" CODE="abc123" errorCode!="null" earliest=@h latest=now | stats count as CurrHour] | where CurrHour>1.5*LastHour

This reports the LastHour and CurrHour values, which I would like. In addition to this I would also like the report to include something like the results from this search when the alert fires:

index=foo_web APPLICATION="foo_web" CODE="abc123" errorCode!="null" earliest=@h latest=now | chart count over errorCode

I'm not sure how to combine these to include both of these in the report output.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this as your alert search

index=foo_web APPLICATION="foo_web" CODE="abc123" errorCode!="null" earliest=-1h@h latest=now 
| eval period=if(_time>=relative_time(now(),"@h"),"CurrHour","LastHour") | chart count over errorCode by period | eventstats sum(CurrHour) as totCurrHour sum(LastHour) as totLastHour | where totCurrHour>1.5*totLastHour 
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...