Alerting

Need help setting up the alerts

theouhuios
Motivator

Hello

I am trying to set up an alert for search and I am not sure why it isn't working. Here is the search

sourcetype="incident"| rename record.assignmentGroup as A , record.affectedCI as B | eval mybucket=case(date_hour<4,1,date_hour<8,2,date_hour<12,3,date_hour<16,4,date_hour<20,5,date_hour>0,6) | stats count as I by B, mybucket,date_mday,date_month,date_year , A, _time |delta I as D | eval D = abs(D) | eventstats avg(I) as xbar, avg(D) as mbar by B | eval threshold = xbar + (2.66*mbar) | eval threshold=coalesce(threshold,0)|table B A I threshold

And the output will be like

    B         A     I   threshold

1 A0058A09 WG7100 1 1.00
2 A0058A09 WG7100 1 1.00
3 A0058A09 WG1675 1 1.00
4 A0058A09 WG1675 1 1.00
5 A0058A09 WG7100 1 1.00

Now I need to set up an alert where I>threshold. Any suggestions on what would be the method to set an alert for this.

Also is it possible to change the subject of alert to give the value of B and the threshold ? Like "Splunk Alert for $B$ with threshold as $threshold$". The subject will need to change according to the B which has crossed its threshold.

Any help?

Regards

theou

Tags (1)
0 Karma

sdaniels
Splunk Employee
Splunk Employee

You should be able to add this onto the end of your search (remove the table command) and create an alert in the UI.

<yoursearch> | where I > threshold     
<yoursearch> | search I > threshold

Here is a simple example from our docs for setting up an alert given a threshold. http://docs.splunk.com/Documentation/Splunk/4.3.4/User/Alertusecases#Base_search_-_Refine_to_provide...

I don't think you can change the subject of the alerts currently but i'll check.

0 Karma

theouhuios
Motivator

I did that now. There isn't much data in this environment. Will get back to you after I get few mails about how its working.

0 Karma

sdaniels
Splunk Employee
Splunk Employee

I just tried float versus int and that seems to be fine on determining greater than. What happens when you keep your search above with the table and you do 'If Custom condition is met' with 'search I > threshold'?

0 Karma

theouhuios
Motivator

Thanks @sdaniels. I did the same when I tried it before. But I wonder why it was sending me emails even when I was equal to the threshold. Under the alerts there are 2 options "Once per search" and "Once per result". I had it setup for result. Would that have been the reason on why it sent me emails even when they are same? I was also wondering if the data would be reason as I would be "int" as 1,2 etc and threshold would be a "float" as 1.00,1.96 etc.

0 Karma

theouhuios
Motivator

Any suggestions?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...