https://community.splunk.com/t5/Splunk-ITSI/Windows-Server-Critical-Service-Status-Change-Can-this-be/m-p/605830#M2548 <P>I want to monitor the critical services running status on a Windows server. Need to trigger ticket if any of the critical service is stopped for x number of minutes. Can this be implemented as normal alert or needs episode to be created? Normal alert have drawback of triggering again and again in case of service is down for longer time.</P> Fri, 15 Jul 2022 17:33:32 GMT santosh_sshanbh 2022-07-15T17:33:32Z https://community.splunk.com/t5/Splunk-ITSI/Windows-Server-Critical-Service-Status-Change-Can-this-be/m-p/605830#M2548 <P>I want to monitor the critical services running status on a Windows server. Need to trigger ticket if any of the critical service is stopped for x number of minutes. Can this be implemented as normal alert or needs episode to be created? Normal alert have drawback of triggering again and again in case of service is down for longer time.</P> Fri, 15 Jul 2022 17:33:32 GMT https://community.splunk.com/t5/Splunk-ITSI/Windows-Server-Critical-Service-Status-Change-Can-this-be/m-p/605830#M2548 santosh_sshanbh 2022-07-15T17:33:32Z https://community.splunk.com/t5/Splunk-ITSI/Windows-Server-Critical-Service-Status-Change-Can-this-be/m-p/610326#M2554 <P>I'd do this with an episode. As you mentioned, you can do this without ITSI a a normal alert but the better way would be doing this out of ITSI. You can close the episode automatically if the service is up again or on the other hand it will can be configured to send a message only once until episode breaks. But regarding the usage of itsi, normally you are monitoring a service availability and for this availability you need running Windows-Services. Won't it be better to cover it like this than just looking for "running-services-on-a-windows-host"?</P> Mon, 22 Aug 2022 12:14:15 GMT https://community.splunk.com/t5/Splunk-ITSI/Windows-Server-Critical-Service-Status-Change-Can-this-be/m-p/610326#M2554 skramp 2022-08-22T12:14:15Z