Splunk Search

How to trigger alert when the index from Down to Running State?

karthi2809
Contributor

How to trigger alert when the index from Down to Running State?
My query is to find index is down.But it will trigger only once.I need to continuously when the index is to running state .

| metadata type=hosts index*_prod | eval age = now() - recentTime | eval status= case(age < 900,"Running",age > 900,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status|where Status= "DOWN"

Tags (5)
0 Karma

pkeenan87
Communicator

Have you looked at the meta woot app? https://splunkbase.splunk.com/app/2949/ This is very helpful in auditing when data sources/indexes are down. There are some panels you could use as a template to convert into an alert

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...