Splunk Search

How to compare 2 searches and alert on the differences?

mbowman6241
New Member

I am trying to alert if one of my servers is left out of load balance for a specific amount of time.

My current search is:

index=netcool $server-ip$ Node | rex field=_raw "Node\s\/Common\/(?<host>.*)\s+address\s(?<ipaddress>[\d\.]+)\ssession status\s(?<status>.*)\." | where status!=" monitor status unchecked" AND status!=" monitor status forced down" | table _time, host, status | sort  -_time | dedup snehost

This gives me a table of all my servers and a status of either "enabled" or "forced disabled" which is perfect. I want to be able to run this search every fifteen minutes and have it generate an alert if the server status is "forced disabled" for an extended period of time.

My original thoughts are, this search runs every 15min and the latest search compares the previous search. Is this possible?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mbowman6241,

run this search every 15min as planed, but have the results written to a lookup file by using the outputlookup command in the search http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Outputlookup
Create a second search or Alert which facilitates the lookup using inputlookup http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Inputlookup to get the last status and compare it with the current, if they differ create an alert.

Hope this makes sense ...

cheers, MuS

0 Karma

mbowman6241
New Member

That makes complete sense. Thank you. Let me see if I can get this to work now.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...