Alerting

Can you help me create an alert that triggers when search results are higher than a specific value in a column?

uvmk61
New Member

I am trying to trigger an alert based on a value that is in a column. Below is the search I am running

|node_details(SERVER NAME) |  search Node_ID="Node3" (stats.key="node.cpu.sys.max" OR stats.key="node.cpu.user.max") | eval usage_by = case('stats.key'="node.cpu.user.max", "User", 'stats.key'="node.cpu.sys.max", "System") | eval stats.value = round(('stats.value'/10),1)| timechart span=5m avg(stats.value) by usage_by 

Basically, I want to alert anytime the System is greater than X.

I have tried using customer alert condition and have added where System > 4

But, that has not helped. Can someone recommend a solution please?
Thanks

alt text

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@uvmk61,

Just a suggestion , if you just want to alert based on one field, you need not select "All Time" and do a timechart because it searches all your events and sends an alert if the condition matches - even for the past (5 years?) . If you are planning to schedule this alert for every let's say x minutes, then it's better to search for last x minutes and send an alert.

For e.g. For last 10 minutes

|node_details(SERVER NAME) |  search Node_ID="Node3" (stats.key="node.cpu.sys.max" OR stats.key="node.cpu.user.max") 
| eval usage_by = case('stats.key'="node.cpu.user.max", "User", 'stats.key'="node.cpu.sys.max", "System") 
| eval stats.value = round(('stats.value'/10),1)
| stats avg(stats.value) as stats.value by stats.key
| where stats.value > 4

If you want to restrict it only for System, use where (stats.key="System" AND stats.value > 4)

Lets know if you have other requirements to use the timechart

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...