topic Re: How to monitor servers using splunk in Getting Data In

How to monitor servers using splunk

2powder — Mon, 02 Oct 2017 15:38:37 GMT

I have been tasked with figuring out how to monitor server activity using splunk and create alerts

Re: How to monitor servers using splunk

somesoni2 — Mon, 02 Oct 2017 15:55:09 GMT

Could you provide more details on what you mean by "server activity"?

Re: How to monitor servers using splunk

2powder — Mon, 02 Oct 2017 17:31:23 GMT

For example, let's say that we have 10 servers that all run the same code. The traffic is load balanced and the code performs a process, that either completes successfully. At the end of the process there is a flag that is set such as "Successful = yes or no". There is also a couple of identifiers such as the vendor ie. "ABC Company" and then there is a unique "Process ID". This process is called real time 24/7. What I am looking for is an alert that will alert me (and others) when a certain threshold has been exceeded. For example, for ABC Company if the Successful = no count < 5 during a certain time period then no alert, but as soon as it goes over 5, then I am alerted.

I hope that this helped.

Thank you

Re: How to monitor servers using splunk

ddrillic — Mon, 02 Oct 2017 18:07:29 GMT

First step is to collect the relevant data from the logs (I assume). The moment you have the data, you can work on the alerts.

Re: How to monitor servers using splunk

2powder — Mon, 02 Oct 2017 20:43:39 GMT

That information is already being collected

Re: How to monitor servers using splunk

davebrooking — Tue, 29 Sep 2020 16:04:38 GMT

maybe this video about creating alerts will help https://www.youtube.com/watch?annotation_id=annotation_2942967387&feature=iv&src_vid=SuARLqm7_jc&v=0REbozaALX0

Dave