Figuring out last host reported data based on lookup

oleg106 — Mon, 12 Apr 2021 19:12:15 GMT

Hello,

Looking for some advice on a popular topping of non reporting hosts. Perhaps someone already came across something like this, or has a better way of doing it.

We have device pairs that report differently, and I am looking for a way to alert if a device stops reporting based on expected reporting cadence for a particular device. For example, have a CSV with device name/IP and a column for the expected reporting threshold that can be used to generate an alert if it is exceeded.

Example:

FW1-primary, 2m
FW1-secondary, 4h

So the search can look at the second column, and if it's been more than 4 hours since FW1-secondary sent an event, an alert can be generated. TIA!

Re: Figuring out last host reported data based on lookup

ericjorgensenjr — Mon, 12 Apr 2021 22:06:51 GMT

I would recommend doing it like this:

Lookup (demolookup):

host,seconds somehostname,60

Your alert search:

topic Figuring out last host reported data based on lookup in Monitoring Splunk

Figuring out last host reported data based on lookup

Re: Figuring out last host reported data based on lookup