Alerting

Cron or Time Period

nijwoolley
New Member

sourcetype=marketops_cmva_extract_generator ORA-08103 | stats count | where count >10

I have the above search and I want to know the best way to alert for when I have 10 entries in the last hour

I set a cron in the alert set up to look at last hour and relative time in search for last hour

Seems it won't save when you have a cron and the hour setting in relative time

whats the best way to do this please?

Tags (2)
0 Karma

dineshraj9
Builder

Your query will return results only when the count is > 10 because of the where condition -

sourcetype=marketops_cmva_extract_generator ORA-08103 | stats count | where count >10

Run this for -1h@h to @h

and set the cron as 0 * * * *

condition as number of events > 0

0 Karma

nijwoolley
New Member

Thanks

What time search period should I use ?

0 Karma

nijwoolley
New Member

I only want it to alert when >10 of these errors so why use "condition as number of events > 0"?

0 Karma

dineshraj9
Builder

You already have a condition in your query where count > 10, so your query will return a result only if count is > 10.

0 Karma

nijwoolley
New Member

Ok cheers

0 Karma

dineshraj9
Builder

Great! Please accept the answer and upvote any comment that has helped you arrive at a solution.

0 Karma

dineshraj9
Builder

You have to run it every hour on top of the hour -

Run this for -1h@h to @h

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Make sure you're actually using relative time like -1h and not real-time like rt-1h.

For more detailed help do share your actual settings that fail, and what message you get when they fail.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...