Alerting

How do I alert on a field if service changed from up to down?

DanielASG
Explorer

Hi all

We are watching 44 critical items in Splunk, and we have a search running to let us know if the service is up or down.

> index="winevents_server" sourcetype=updown | lookup updownhosts.csv IP OUTPUT Device_name,Use,Model | dedup IP | rename stats as status |table _time,IP Device_name, Model, status
> Blockquote

how can we alert if any of the values change from up to down or down to up ?

i know how to alert on each one, but I did not want 44 searches running at once. is there a way of doing this with one search?

Tags (3)
0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Something like this might work.

index="scratchpad" sourcetype="downtoup" 
| dedup status consecutive=true 
| head 2 
| stats count 
| where count=2

The consecutive parameter for the dedup command will dedup until the value changes, then dedup again. I tested with the value changing 4 times and I ended up with 4 events, even though I had more. Using head 2 gives you the last 2 values within the time window you are searching in. If the count is 2, it would indicate that the status has changed in that time window.

View solution in original post

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Something like this might work.

index="scratchpad" sourcetype="downtoup" 
| dedup status consecutive=true 
| head 2 
| stats count 
| where count=2

The consecutive parameter for the dedup command will dedup until the value changes, then dedup again. I tested with the value changing 4 times and I ended up with 4 events, even though I had more. Using head 2 gives you the last 2 values within the time window you are searching in. If the count is 2, it would indicate that the status has changed in that time window.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...