All Apps and Add-ons

How does mark hosts as down work?

kaddupa1
Explorer

Hi,

can you describe shortly how this TA works and how i can use it properly?
thanks.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

It looks as if this TA is using macros to populate a lookup. So an example to mark a host "down" might go something like this ( = backtick):

earliest=-1m@m sourcetype=iis http_status=500 | stats count by host | where count > 200 | map search="<BT>mark_host_down($host$)<BT>"

Basically, you can funnel any string and have it populate a lookup with either up or down status.
Once you have the host marked, you can use the lookup to write reports.

earliest=-20m@m sourcetype=iis [|inputcsv server_down | rename server_name as host]| stats count by host

This will show you what servers are down, and their events.

To clarify: I did NOT write the TA, nor would I recommend its use. After looking at the code, it seems kinda "hackish" and doesn't use optimizations, provide much useful data enrichment other than "the server name is down" lookup, and does not follow Developing Apps Best practices (it has stuff in the local folder.....). Use at your own risk, but you might be better off writing something else that has more data enrichment (the server name with status [hardware down, software down, etc], first seen down, last seen down, resolved time, etc).

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi alacercogitatus, thanks for your feedback. It was indeed just a simple try to get an option to quiet out alerts for host with known problems. Data enrichment was not needed in this case, but could be added to the next release.....

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...