Website Monitoring: How to assign email recipients for outage alerts?

[sj0man]

Hi,
I have a question.

There is a description in documentation of 'Website Monitoring' app.
Email Outage Alerting: get an emailed alert when your website is down (responds too slowly or is returning an error)
How to assign receivers of emailed alert?

TIA

[LukeMurphey · Accepted solution]

Here are directions on how to set this up.

Step 1: Splunk Configuration
You will need to configure Splunk to work with an email server. To set this up, go the Splunk Manager at Server settings » Email settings.

Step 2: Configuring the Search
The app includes a search named "website_performance_problems" that works well for email alerting. To configure it for email alerting, open the "website_performance_problems" search in the Manager (Manager » "Searches, reports, and alerts"). Click the checkbox next to "Send email" alert action to enable it and complete the information necessary to use the alert action.

Step 3: Customizing Response Time Threshold (optional)
You may want to change the threshold that is used to determine if a site has been down too long. To do so, edit the "response_time_threshold" macro. You can change the macro in the Manager by going to "Advanced search" » "Search macros" and editing the "response_time_threshold" macro.

Step 4: Filtering Out Sites (optional)
You may want not want to receive email notifications for some sites. To filter these sites out, add a where clause to the "website_performance_problems" search just after the first search part. Below is an example of a search using where clauses to filter out some sites:

sourcetype="web_ping" (response_code>=400 OR timed_out=True) OR (total_time>`response_time_threshold` NOT (title="LukeMurphey.net") ) | where NOT like(url,"%splunk.com%") | fillnull response_code value="Connection failed" | eval response_code=if(timed_out == "True", "Connection timed out", response_code) | stats count as count max(total_time) as max_total_time by title url response_code | eval max_total_time=round(max_total_time, 2)." ms" 

[MichaelPriest]

When you create the alert you can input the receivers for emails, read about alerts here:

http://docs.splunk.com/Documentation/Splunk/6.2.3/alert/Aboutalerts