Alerting

If we have an alert that tells us when a service is stopped, how can we create an alert that will also check if the service remains down?

luise
New Member

Hello,

We have an alert that tells us when a service stopped. However, the services will sometimes restart. How can we have an alert that will also check if the service remains down?

Is it possible?

Thanks,
Luis Embalo

0 Karma

sundareshr
Legend

Maybe something like this might work

index=* "success" earliest=[search index=* "failed" | timechart latest(failed) as earliest | fields earliest] | stats count 

If the count is 0 its probably because the service hasn't restarted.

0 Karma

luise
New Member

That searches for a service that is down.. what I am looking for is for way that sees the service as going down, and then keeps watching to see if it came up. If it came up, then nothing happens.. if it did not come up, then alerts.

Is that possible?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...