Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Alert condition to count total events instead of count by

$
0
0
I have the below sample splunk query that returns me count by Errors - index="abc" earliest=-1h "/payment_items" "Exception" | rex field=_raw "Exception:\s"(?.*)"" | fields request_id, Error | dedup request_id | eval Errors=case(Error like "%invalidArgument%","InvalidArgument", Error like "%ApplicationException%", "ApplicationException", Error like "%", Error) | stats count by Errors | sort by count desc When setting up alert, I want to trigger an alert when the total count of error (not the count by individual error) is greater than 10. How can I achieve that ? Please help ASAP

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>