topic Query Question in Alerting

Query Question

lanmanjs55 — Wed, 22 Jul 2020 16:01:05 GMT

We have a number of alerts set up with Splunk. One of them monitors the state of VPN's from our Cisco routers. One of these routers has a couple of VPN's that are actually supposed to be down (until they get traffic sent over them) so we keep getting a false positive on the alert. This is the query:

splunk query - sourcetype="cisco:ios" AND "down"

I am VERY new to this and writing queries. What is the syntax I need to add to this query that will ignore this one particular router?

Thank you for any Reply -

Re: Query Question

richgalloway — Wed, 22 Jul 2020 17:28:37 GMT

Add the name of the router to the query.

sourcetype="cisco:ios" AND "down" AND NOT host="name of router"

Re: Query Question

lanmanjs55 — Wed, 22 Jul 2020 17:30:40 GMT

Excellent - thank you very much for the Reply. Looks really easy but it just shows I have a lot to learn. Much approciated.