topic Re: Alert for a Specific host Shutdown more then 5 min, Splunk send out an alert in Alerting

Alert for a Specific host Shutdown more then 5 min, Splunk send out an alert

shakeel253 — Mon, 11 Sep 2017 15:33:57 GMT

Does anyone knows of a specific query that can used as an alert, if the host shutdown for more then 5 min, it triggers an alert and identifies user

Re: Alert for a Specific host Shutdown more then 5 min, Splunk send out an alert

saurabhtcs — Tue, 29 Sep 2020 15:42:26 GMT

You can try the below search to get alert in case any host is down for more than 5 minutes:

| tstats count latest(_time) where index=* by host
| rename earliest(_time) as earliest_time, latest(_time) as latest_time
| eval status= if(latest_time > relative_time(now(),"-5min"),"Active","Inactive")
| convert ctime(latest_time)
| search status="Inactive"
| fields - count

Re: Alert for a Specific host Shutdown more then 5 min, Splunk send out an alert

shakeel253 — Mon, 11 Sep 2017 16:42:18 GMT

i want to set this query for a specific host such as host=tableau, what should i change with in the query

Re: Alert for a Specific host Shutdown more then 5 min, Splunk send out an alert

somesoni2 — Mon, 11 Sep 2017 17:10:27 GMT

Add host=yourhost OR host=yourhost1 OR host=yourhost2... just after the index=* and before by host in line1.

Re: Alert for a Specific host Shutdown more then 5 min, Splunk send out an alert

shakeel253 — Mon, 11 Sep 2017 17:44:14 GMT

thankyou Somesoni, that was helpful, appreciate you and saurabhtcs help 🙂

Re: Alert for a Specific host Shutdown more then 5 min, Splunk send out an alert

somesoni2 — Mon, 11 Sep 2017 17:51:54 GMT

Glad we were able to you help you with your requirement. If there are not follow-up questions in same topic, do remember to close the question by accepting the answer (and upvoting it).

Re: Alert for a Specific host Shutdown more then 5 min, Splunk send out an alert

shakeel253 — Tue, 29 Sep 2020 17:20:21 GMT

@somesoni2 @saurabhtcs when i used the query, if i shutdown the host, nothing comes up when i ran the query. It only shows result for last 24hrs. I started/stopped the host and ran this query but it didnt give desired result. The desire result which i want is, if the host is shutdown, the query has been setup as alert and should be able to inform user that host is shutdown or not responding with the updated timestamp

| tstats count latest(_time) where index=* host="abssvm" by host | rename earliest(_time) as earliest_time, latest(_time) as latest_time | eval status= if(latest_time > relative_time(now(),"-5min"),"Active","Inactive") | convert ctime(latest_time) | search status="Inactive" | fields - count

Re: Alert for a Specific host Shutdown more then 5 min, Splunk send out an alert

saurabhtcs — Fri, 22 Dec 2017 09:46:30 GMT

You should get an alert after 5 minutes. Since the threshold given in the search is 5mins, you will get an alert on after five minutes of the host being down (and the alert runs at that time).