Alerting

monitor change of a particular field

spyme72
Path Finder

i want to monitor a field called state which can have 2 values , stopped and running.
i want to alert when ever the state changes from running to stopped or from stopped to running.

Event:
Caption=WWAN AutoConfig
DisplayName=WWAN AutoConfig
Name=WwanSvc
ProcessId=0
StartName=NT Authority\LocalService
State=Stopped
Status=OK
SystemName=R9R8CF1
wmi_type=Services

Tags (2)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Maintaining state is greatly described here: http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/. The best way to keep track is with lookups. If you run a search every 5 minutes, dedup will only know of state changes within that time range, and no longer, and running dedup over large datasets can become memory intensive. Read the article, and then repost with some specific questions if you have them.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Maintaining state is greatly described here: http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/. The best way to keep track is with lookups. If you run a search every 5 minutes, dedup will only know of state changes within that time range, and no longer, and running dedup over large datasets can become memory intensive. Read the article, and then repost with some specific questions if you have them.

lukejadamec
Super Champion

What answer 🙂

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

But in your answer, you specify that you are running a search every 5 minutes, which dedup will only look within whatever time range you pick. Dedup is especially more expensive a search, as it requires the events to be returned to the searchhead before throwing them away.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...