Splunk Search

stats count for alert

shangshin
Builder

Hi, Our web server is fronted by a load balancer with 3 different VIPs

I am using the search string below to see the stats

sourcetype="access_log" (ip="10.10.10.10" OR ip="11.11.11.11" OR ip="12.12.12.12") | stats count by ip

On the other hand, I would like to get the alert if any of the count is 0.

Can you shed some light on the search string?

Thanks!

Tags (4)
0 Karma
1 Solution

ziegfried
Influencer

A clean approach is to create a CSV lookup file and join it with your given query:

Lookup file in $SPLUNK_HOME/etc/apps/search/lookups/loadbalancers.csv:

ip
10.10.10.10
11.11.11.11
12.12.12.12

Then you should be able to create an alert using the following query:

| inputlookup loadbalancers.csv | join type=outer ip [ search sourcetype="access_log" (ip="10.10.10.10" OR ip="11.11.11.11" OR ip="12.12.12.12") | stats count by ip ] | where NOT count>0

(using the condition "number of events" greater than 0)

View solution in original post

0 Karma

ziegfried
Influencer

A clean approach is to create a CSV lookup file and join it with your given query:

Lookup file in $SPLUNK_HOME/etc/apps/search/lookups/loadbalancers.csv:

ip
10.10.10.10
11.11.11.11
12.12.12.12

Then you should be able to create an alert using the following query:

| inputlookup loadbalancers.csv | join type=outer ip [ search sourcetype="access_log" (ip="10.10.10.10" OR ip="11.11.11.11" OR ip="12.12.12.12") | stats count by ip ] | where NOT count>0

(using the condition "number of events" greater than 0)

0 Karma

shangshin
Builder

Beautiful solution.
Much appreciated!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...