topic Re: Alert when a Windows Service stops in Alerting

Alert when a Windows Service stops

Razzi — Fri, 26 Apr 2024 13:59:42 GMT

I am fairly new to the Splunk platform/ community; I am in learning mode 😞 and I hope to get some help here. How do I set up/configure an alert on a set of Windows Servers to notify me when a particular set of services stops? For example, I have three services that start with the naming of TDB, how can I configure Splunk to alert if any of those services stop on a particular server name. Thanks much.

Re: Alert when a Windows Service stops

gcusello — Fri, 26 Apr 2024 14:09:51 GMT

Hi @Razzi,

you should define the fields that you can use to identify the fields to use:

host (it's the host present in each log),
process.

Then you should create a lookup (called e.g. perimeter.csv) containing the hosts to monitor (supponing that the three services to monitor must be active in all the servers).

Then you should run a search like the following:

Ciao.

Giuseppe

Re: Alert when a Windows Service stops

Teddiz — Wed, 25 Sep 2024 08:43:46 GMT

can you explain me where I put the perimeter.csv and can you show me a little example how this file looks like?

thx

Re: Alert when a Windows Service stops

PickleRick — Wed, 25 Sep 2024 11:03:35 GMT

One important thing - Splunk is not a "monitoring tool". So it will not tell you about the state of the service (unless you have a specific input listing states of services periodically but as far as I know there is no such input by default). You will only be able to see an event saying that the service has stopped or crashed or whatever if such event is logged (and if you're ingesting such events).

Re: Alert when a Windows Service stops

gcusello — Wed, 25 Sep 2024 12:38:46 GMT

hi @Teddiz ,

perimeter.csv is a csv file containing only one column (host) and the list of the hostname to monitor:

host my_host1 my_host2 my_host3 my_host4

Ciao.

Giuseppe

Re: Alert when a Windows Service stops

Teddiz — Mon, 21 Oct 2024 10:00:08 GMT

Thx Giuseppe!

Re: Alert when a Windows Service stops

gcusello — Mon, 21 Oct 2024 18:43:23 GMT

Hi @Teddiz ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉