https://community.splunk.com/t5/Alerting/How-to-send-an-alert-for-alert-resolution/m-p/612120#M14219 <P>I want to send an alert when a situation has been corrected. for example If i setup an alert for low diskspace on a host and I set this alert up to check every 15 minutes, with range back 15 minutes. I will get an alert until I correct the low disk issue on the host. but what I want is that when the problem is corrected, splunk somehow would know that it needs to send an "Alert resolved" out. The problem is I only want it to send that "Alert resolved" message out only after an alert was sent out that it was a problem.</P> <P>I would think that somehow a flag for an alert would need to be set when an alert is thrown so that when the condition is corrected, Splunk has a way to know that the previously it was a problem and it would send the "Alert resolved" alert</P> <P>Anyone know of a way to do this?<BR />Gary</P> <P>&nbsp;</P> Wed, 07 Sep 2022 19:44:14 GMT giga444 2022-09-07T19:44:14Z https://community.splunk.com/t5/Alerting/How-to-send-an-alert-for-alert-resolution/m-p/612120#M14219 <P>I want to send an alert when a situation has been corrected. for example If i setup an alert for low diskspace on a host and I set this alert up to check every 15 minutes, with range back 15 minutes. I will get an alert until I correct the low disk issue on the host. but what I want is that when the problem is corrected, splunk somehow would know that it needs to send an "Alert resolved" out. The problem is I only want it to send that "Alert resolved" message out only after an alert was sent out that it was a problem.</P> <P>I would think that somehow a flag for an alert would need to be set when an alert is thrown so that when the condition is corrected, Splunk has a way to know that the previously it was a problem and it would send the "Alert resolved" alert</P> <P>Anyone know of a way to do this?<BR />Gary</P> <P>&nbsp;</P> Wed, 07 Sep 2022 19:44:14 GMT https://community.splunk.com/t5/Alerting/How-to-send-an-alert-for-alert-resolution/m-p/612120#M14219 giga444 2022-09-07T19:44:14Z https://community.splunk.com/t5/Alerting/How-to-send-an-alert-for-alert-resolution/m-p/612260#M14221 <P>You haven't provided much details about your data but in general you can try something like that:<BR /><BR />| stats min(disk_usage) as min_usage max(disk_usage) as max_usage&nbsp;<BR />| where min_usage &lt; threshold and max_usage &gt; threshold</P><P>This needs to be run for a time range which will cover at least 2 last disk usage samples.</P><P>I assume that you already have an alert to be triggered when disk_usage is above the threshold</P> Wed, 07 Sep 2022 11:57:46 GMT https://community.splunk.com/t5/Alerting/How-to-send-an-alert-for-alert-resolution/m-p/612260#M14221 JacekF 2022-09-07T11:57:46Z https://community.splunk.com/t5/Alerting/How-to-send-an-alert-for-alert-resolution/m-p/612309#M14222 <P>It's the alert that goes out <U>after</U> the alert threshold is breached but then recovers for whatever reason.&nbsp; For example... I have an alert that triggers if my disk space drops below 10% and a text is sent out. if a host then does drop below the 10%, Splunk does send an alert out that the the diskspace is below 10%. At that time someone from our team logs on and adds diskspace that bringing the diskspace back up to 20%. The alert stops triggering. All this works fine.&nbsp;</P><P>what&nbsp; I want is (more of a notification than an alert) to be sent out that the diskspace issue has been resolved.&nbsp;</P> Wed, 07 Sep 2022 19:39:10 GMT https://community.splunk.com/t5/Alerting/How-to-send-an-alert-for-alert-resolution/m-p/612309#M14222 giga444 2022-09-07T19:39:10Z https://community.splunk.com/t5/Alerting/How-to-send-an-alert-for-alert-resolution/m-p/612360#M14223 <P>Then it looks like you need a query with a time range covering last two samples, and then compare latest value with the earliest. If latest value is below the threshold and earliest is above it, it means that there is more free space available and an alert (notification) can be sent.</P><P>Or maybe I completely misunderstood your case?</P> Thu, 08 Sep 2022 07:03:16 GMT https://community.splunk.com/t5/Alerting/How-to-send-an-alert-for-alert-resolution/m-p/612360#M14223 JacekF 2022-09-08T07:03:16Z https://community.splunk.com/t5/Alerting/How-to-send-an-alert-for-alert-resolution/m-p/612458#M14226 <P>JacekF,&nbsp;<BR />Brilliant! how creative. I had not thought of doing it that way.&nbsp;</P><P>Thank you</P><P>Gary</P> Thu, 08 Sep 2022 18:21:00 GMT https://community.splunk.com/t5/Alerting/How-to-send-an-alert-for-alert-resolution/m-p/612458#M14226 giga444 2022-09-08T18:21:00Z