Alerting

I need a specific exception in the alert where it should trigger an alert if the condition is >5

sk10
New Member

I was trying to create an exception where it should trigger an alert if the specific exception goes above 5. Can some one check and suggest me on the alert.

eval Err=if(match("XXX.XXXXException",>5),"OK","")

Tags (1)
0 Karma

jpolvino
Builder

You can design your search so that if everything is ok, it returns 0 rows. Then if it returns > 0 rows, this indicates an issue that fires the alert. You can do this by doing the first part suggested by skoelpin above, followed by this:

| where ERR>5

Then your alert can fire when number of results is > 0. We use this so the alert stays quiet unless the threshold (indicated by some rows coming back) is breached.

0 Karma

skoelpin
SplunkTrust
SplunkTrust

The match function uses the field name followed by a regular expression. You're missing the regular expression from here

Try this, replace <FIELD> with your field name

| eval Err=if(match(,"\w+Exception"),1,0)
| eval ALERT=if(Err>5,"OK","GOOD")

https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/ConditionalFunctions#match.28SUBJ...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...