topic Wait logic in Splunk query in Splunk Cloud Platform

Wait logic in Splunk query

ManjunathNargun — Tue, 03 Oct 2023 14:33:06 GMT

Hi All,

How can we implement the wait logic in a Splunk query.

We monitor the Service down traps primarily and create Splunk alerts.

We have requirement now, to wait for a time interval and check if the service UP trap received if yes then don't create alert else create an alert. How can we implement this in a single query? Any suggestion please.

Example: If ServiceDown trap received:

Wait for 5 minutes.

If Good trap received:

Return

Else:

Create alarm.

Thanks!

Re: Wait logic in Splunk query

richgalloway — Tue, 03 Oct 2023 15:29:10 GMT

Look at it another way. Search the last 5 minutes. If a ServiceDown trap was received without a matching Good trap then create an alarm.

index=foo (trap=ServiceDown OR trap=Good) earliest=-6m | dedup ```add a field that contains device name``` | where trap=ServiceDown AND _time <= relative_time(now(), "-5m")

Trigger the alert if the search returns results.

Re: Wait logic in Splunk query

ManjunathNargun — Wed, 25 Oct 2023 12:40:14 GMT

@richgalloway Hi , Tried the below one.

we are getting error as below.

Error in where command: The operator at '::trapdown AND _time<=relative_time(now(),"-5m") is invalid.

Please help me.

Thanks!

Re: Wait logic in Splunk query

richgalloway — Wed, 25 Oct 2023 19:08:09 GMT

Have you tried something like this (assuming ServiceDown is a string)?

index=foo (trap=ServiceDown OR trap=Good) earliest=-6m | dedup ```add a field that contains device name``` | where (trap="ServiceDown" AND _time <= relative_time(now(), "-5m"))