Splunk Search

How to generate a search where the count is greater than 0 after 5 days?

nickyp86
Engager

I need to see if errors are still continuing after 5 days. If they are there then there is an issue and I need it to be displayed. I'm not sure how to show that. Please let me know if you need additional details.

0 Karma
1 Solution

mparks11
Path Finder

Probably need more details here, but you could do your base search for "errors" and have that run for the last 5 days, then pipe those results to stats and distinct count the days over which the errors existed, then trigger an alert if that distinct count >= 5.

index=foo sourcetype=bar "error" earliest=-5d | stats dc(date_wday) as days

Save As Alert then set a Trigger Condition for when days>=5.

Something like that maybe!

View solution in original post

mparks11
Path Finder

Probably need more details here, but you could do your base search for "errors" and have that run for the last 5 days, then pipe those results to stats and distinct count the days over which the errors existed, then trigger an alert if that distinct count >= 5.

index=foo sourcetype=bar "error" earliest=-5d | stats dc(date_wday) as days

Save As Alert then set a Trigger Condition for when days>=5.

Something like that maybe!

nickyp86
Engager

This is perfect. Thank you!

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...