Search help please

surajsplunkd — Fri, 30 Jun 2023 05:46:10 GMT

Good morning!! I am a Beginner in Splunk, below query only tell me whether HF is DOWN or HEALTHY.

++++++++++++++++++++++++++++++

`internal` source="/opt/splunk/var/log/splunk/metrics.log" fwdType=full | search NOT hostname=*cbl* NOT hostname=*cwn* NOT hostname=*SCO* NOT hostname=*SGW* NOT hostname=*spft* NOT hostname=*tsps* NOT hostname=*psps* NOT hostname=*puba* NOT hostname=aue11pspf001* NOT hostname=aue12pspf001*| dedup hostname | stats count as historic_count | appendcols [search `internal` source="/opt/splunk/var/log/splunk/metrics.log" fwdType=full earliest=-5m latest=now | search NOT hostname=*cbl* NOT hostname=*cwn* NOT hostname=*SCO* NOT hostname=*SGW* NOT hostname=*spft* NOT hostname=*tsps* NOT hostname=*psps* NOT hostname=*puba* NOT hostname=aue11pspf001* NOT hostname=aue12pspf001*| dedup hostname | stats count as recent_count] | eval count = historic_count - recent_count | rangemap field=count low=0-0 severe=1-100 | eval health = if(count>0, "HF DOWN", "HEALTHY") | eval count = health | table count health range

++++++++++++++++++++++++

Could you please help me modify this to find which HOST is DOWN?

Immediate response is highly appreciated.

Thanks, in advance.

Re: Search help please

isoutamo — Fri, 30 Jun 2023 06:19:34 GMT

There are several ways to do it. You could add all your HF on MC as on indexers and create own custom groups for them. Then MC monitor those and alert you when any of those has issues.
Another way is e.g. use this kind of solution https://community.splunk.com/t5/Monitoring-Splunk/Splunk-Universal-Forwarder-monitoring/m-p/304230 . You need to modify your original query by adding this Perimeter.csv part instead of what you have starting appendcols. Then your need another Savedsearch to update that Perimeter.csv time by time.

r. Ismo

topic Re: Search help please in Splunk Enterprise

Search help please

Re: Search help please