Alerting

Configure an alert based on the number of results as warning, high, critical in same alert

chandrasekharko
Path Finder

I want to configure an alert with different thresholds as in

Warning - count > 5
High - count > 10
Critical - Count > 15

If there are 10 results in the count then I need to get an alert saying it is critical not the the warning and high.

0 Karma
1 Solution

woodcock
Esteemed Legend

Add this to the end of your search:

| eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")

Then in your email you can use $result.criticality$ in your subject line and count>5 for your threshold.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

You want to set Severity based on count OR will a Text in subject line with Severity is ok?

0 Karma

chandrasekharko
Path Finder

Based on count

0 Karma

woodcock
Esteemed Legend

Add this to the end of your search:

| eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")

Then in your email you can use $result.criticality$ in your subject line and count>5 for your threshold.

chandrasekharko
Path Finder

What does N/A means here?
The subject looks like this:
Working On it N/A
It should say Working On it Critical as the results are around 20

0 Karma

woodcock
Esteemed Legend

You used both count and Count; make sure that the search is correct and that it generates the correct value for criticality based on Count/count and then it should work.

0 Karma

chandrasekharko
Path Finder

This is how my query looks like after the search:

|eval time=strftime(_time, "%m/%d/%y %I:%M:%S:%p") | table time,host,c_ip,cs_uri_stem,s_ip,s_port,sc_status,sc_substatus,time_taken | eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")

Am I doing anything wrong here?

0 Karma

woodcock
Esteemed Legend

You have not calculated a count field! Maybe something like this:

|eval time=strftime(_time, "%m/%d/%y %I:%M:%S:%p")
| stats count BY host c_ip cs_uri_stem s_ip s_port sc_status sc_substatus time_taken
| eval criticality=case((count>15), "Critical", (count>10), "High", (count>5), "Warning", true(), "N/A")
0 Karma

chandrasekharko
Path Finder

Sorry for keep bugging you on this. The criticality still showing me as N/A

0 Karma

woodcock
Esteemed Legend

What I wrote ABSOLUTELY works. We are going to have to stop playing the "this isn't really my search" game and you'll have to post your real search if you need to get it right. For example, in your fragment you are calculating time but not using it....

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...