https://community.splunk.com/t5/Alerting/Pausing-a-single-forwarder/m-p/579498#M13344 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/241806">@JRG_Jeff</a>,</P><P>you could insert in your missing forwarder alert a lookup to whitelist the forwarder to check or to blacklist the forwarders to not check.</P><P>In other words, if the liste of the forwarders to check is in a lookup called parameter.csv, you could use a search like this:</P><LI-CODE lang="markup">| metasearch index=_internale | eval host=lower(host) | stats count BY host | append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0</LI-CODE><P>in this way you check only the forwarders in perimeter and to avoid an alert for in maintenance forwarder, you can temporary delete it from the lookup.</P><P>Otherwise, you could create a blacklist lookup (called e.g. blacklisted_forwarders.csv9 and run something like this:</P><LI-CODE lang="markup">| metasearch index=_internale NOT [ | inputlookup blacklisted_forwarders.csv | fields host ] | eval host=lower(host) | stats count BY host | append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Wed, 29 Dec 2021 15:59:47 GMT gcusello 2021-12-29T15:59:47Z https://community.splunk.com/t5/Alerting/Pausing-a-single-forwarder/m-p/579496#M13343 <P>Hi there!</P><P>I have a server that will be down for sometime, and I would like to not be inundated with "missing forwarder" alerts.&nbsp; Is there a way to "pause" that alert for just that server?</P><P>&nbsp;</P><P>Thanks in advance!</P> Wed, 29 Dec 2021 15:53:29 GMT https://community.splunk.com/t5/Alerting/Pausing-a-single-forwarder/m-p/579496#M13343 JRG_Jeff 2021-12-29T15:53:29Z https://community.splunk.com/t5/Alerting/Pausing-a-single-forwarder/m-p/579498#M13344 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/241806">@JRG_Jeff</a>,</P><P>you could insert in your missing forwarder alert a lookup to whitelist the forwarder to check or to blacklist the forwarders to not check.</P><P>In other words, if the liste of the forwarders to check is in a lookup called parameter.csv, you could use a search like this:</P><LI-CODE lang="markup">| metasearch index=_internale | eval host=lower(host) | stats count BY host | append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0</LI-CODE><P>in this way you check only the forwarders in perimeter and to avoid an alert for in maintenance forwarder, you can temporary delete it from the lookup.</P><P>Otherwise, you could create a blacklist lookup (called e.g. blacklisted_forwarders.csv9 and run something like this:</P><LI-CODE lang="markup">| metasearch index=_internale NOT [ | inputlookup blacklisted_forwarders.csv | fields host ] | eval host=lower(host) | stats count BY host | append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Wed, 29 Dec 2021 15:59:47 GMT https://community.splunk.com/t5/Alerting/Pausing-a-single-forwarder/m-p/579498#M13344 gcusello 2021-12-29T15:59:47Z https://community.splunk.com/t5/Alerting/Pausing-a-single-forwarder/m-p/579500#M13345 <P>There is no built-in way to do that with core Splunk.&nbsp; You have to modify the alert to ignore the forwarder.&nbsp; When maintenance is over, remember to revert the alert.&nbsp;</P><P>Consider having the alert consult a lookup file of servers to ignore.&nbsp; Then you just have to update the file when a server is going to be unavailable.</P> Wed, 29 Dec 2021 16:01:56 GMT https://community.splunk.com/t5/Alerting/Pausing-a-single-forwarder/m-p/579500#M13345 richgalloway 2021-12-29T16:01:56Z