I have a scenario where I need to build an alert for a search that triggers on a numerical value. I need to set a threshold and alert that triggers only when that threshold is exceeded, and then have the alert reset once the value is under that threshold.
So basically, var2 returns a NUMERICAL_VALUE, which is the numerical value that I need to alert on.
For example:
I have the alert search set to run every two minutes.
Thanks if anyone has any answers.
index=someindex sourcetype="somesourcetype" source="somesource" Var1="StaticValue" Var2=StaticValue | dedup VAR1 VAR2 | where NUMERICAL_VALUE > 5
Keep track of your alert state in a lookup table; you need 2 searches like these:
Set Alert (fire once):
index=someindex sourcetype="somesourcetype" source="somesource" VAR1="StaticValue" VAR2="StaticValue"
| dedup VAR1 VAR2
| where NUMERICAL_VALUE > 5
| table VAR1 VAR2 NUMERICAL_VALUE
| lookup YourLookupFileNameHere.csv VAR1 VAR2 OUTPUT fired_time
| where isnull(fired_time)
| eval fired_time=now()
| outputlookup coverride_if_empty=false YourLookupFileNameHere.csv
Then create another scheduled search to clear out the lookup file when NUMERICAL_VALUE < 5.
I would use a lookup table to keep the current state
index=someindex sourcetype="somesourcetype" source="somesource" Var1="StaticValue" Var2=StaticValue | dedup VAR1 VAR2 | eval state=if(NUMERICAL_VALUE > 5, 1, 0) | lookup alertstate.csv host OUTPUT state AS previous_state | outputlookup override_if_empty=false alertstate.csv | where previous_state<state