topic Re: Problem with lookup for disabling alerts during maintenance in Alerting

Problem with lookup for disabling alerts during maintenance

jmoeller — Wed, 08 Aug 2018 19:56:43 GMT

Sorry for the simple question, I am new to the Splunk world....

I have a CSV loaded (StandardMaintenance.csv) which has two rows

UnderMaintenance
NO

I want to add a check to each alert so that they will not fire during maintenance.

Here is my code...

....query goes here...
| lookup StandardMaintenance.csv UnderMaintenance
| search NOT UnderMaintenance="NO"

What am I doing wrong or how better might I accomplish this?

Thanks.

Re: Problem with lookup for disabling alerts during maintenance

nvanderwalt_spl — Thu, 09 Aug 2018 01:38:27 GMT

Do you want to put all the things in downtime?
If you had only a few hosts in the lookup at any time, you could do something like this:

search string NOT [|inputlookup hosts_in_maint.csv | table  host| format]

Re: Problem with lookup for disabling alerts during maintenance

renjith_nair — Thu, 09 Aug 2018 01:43:29 GMT

What are you looking up against i.e. what's matching criteria in search and lookup?
Also in the above search if you want only those events which is not under maintenance , you should use

| search UnderMaintenance="NO"

Re: Problem with lookup for disabling alerts during maintenance

jmoeller — Thu, 09 Aug 2018 01:45:59 GMT

I am sorry I wasn't clear. I want it to function as a simple on/off. If maintenance is ON, don't run the search. If maintenance is off, run it normally.

Thanks for your input.

Re: Problem with lookup for disabling alerts during maintenance

fferozbasha — Thu, 09 Aug 2018 02:15:06 GMT

The Inputlookup command supports where condition which means the better way to filter down the search will be

| inputlookup StandardMaintenance WHERE UnderMaintenance="Yes"

What columns do you expect out of the lookup and added in the filter in base search? Ex - If it is to find the list of Hosts that are not under maintenance and consider them for alerting, sample query can be -

Re: Problem with lookup for disabling alerts during maintenance

jmoeller — Thu, 09 Aug 2018 13:13:28 GMT

Thanks. I have no additional information in the StandardMaintenance table. I simply want to use the table as a check... If UnderMaintainance is NO, execute query (thus generate an alert).

To use your example, I want to run the index=os sourcetype=vmstat query only when UnderMaintainence is "NO"

I know I should be able to deduce it from what you provided, but I am still struggling. Any additional input is appreciated.

Re: Problem with lookup for disabling alerts during maintenance

fferozbasha — Sat, 11 Aug 2018 00:51:56 GMT

The query that i have provided should do the same. It will run search a Index=os ONLY if there any hosts tagged as UnderMaintenance=Yes.

Re: Problem with lookup for disabling alerts during maintenance

jmoeller — Sat, 11 Aug 2018 01:02:16 GMT

Thanks for the response. The CVS file only consists of the one field. I want maintenance to be either on or off. If off, run query, if on, don't run query. I am not marking individual hosts, it is all or nothing.

Thanks

Re: Problem with lookup for disabling alerts during maintenance

nagarjuna559 — Sat, 11 Aug 2018 13:47:42 GMT

| lookup StandardMaintenance.csv UnderMaintenance
| where UnderMaintenance="NO"

fields values you use after where are the case sensitive,

Re: Problem with lookup for disabling alerts during maintenance

nagarjuna559 — Sat, 11 Aug 2018 13:49:20 GMT

| lookup StandardMaintenance.csv

| where UnderMaintenance="NO"