Splunk Search

How to generate a search where the count is greater than 0 after 5 days?

nickyp86
Engager

I need to see if errors are still continuing after 5 days. If they are there then there is an issue and I need it to be displayed. I'm not sure how to show that. Please let me know if you need additional details.

0 Karma
1 Solution

mparks11
Path Finder

Probably need more details here, but you could do your base search for "errors" and have that run for the last 5 days, then pipe those results to stats and distinct count the days over which the errors existed, then trigger an alert if that distinct count >= 5.

index=foo sourcetype=bar "error" earliest=-5d | stats dc(date_wday) as days

Save As Alert then set a Trigger Condition for when days>=5.

Something like that maybe!

View solution in original post

mparks11
Path Finder

Probably need more details here, but you could do your base search for "errors" and have that run for the last 5 days, then pipe those results to stats and distinct count the days over which the errors existed, then trigger an alert if that distinct count >= 5.

index=foo sourcetype=bar "error" earliest=-5d | stats dc(date_wday) as days

Save As Alert then set a Trigger Condition for when days>=5.

Something like that maybe!

nickyp86
Engager

This is perfect. Thank you!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...