topic Re: Alert UP and Down By Status Code in Dashboards & Visualizations

Alert UP and Down By Status Code

bernanda — Tue, 02 Feb 2021 03:46:17 GMT

Hi Splunk,

Newbie here 😅 want to ask about alert.

for example we have data like

Name	Time	StatusCode
AAA	2021-02-02 08:00	404
AAA	2021-02-02 08:01	200
BBB	2021-02-02 09:00	503
CCC	2021-02-02 09:01	404
BBB	2021-02-02 09:30	200
CCC	2021-02-02 09:30	200

How to create a alert base on table with cron every per 5 minutes. if StatusCode != 200 alert notif startdown and if StatusCode =200 alert notif Solved.

Example for the alert base on table:

"Hi AAA, you are down on 2021-02-02 08:00"

and email again if the AAA StatusCode changed to 200

"Hi AAA, you are now SOLVED on 2021-02-02 08:01"

done, until the StatusCode Changed to !=200 the alert send me the email again.

Another Example:

"Hi BBB, you are down on 2021-02-02 09:00"

then the StatusCode Changed to 200

"Hi BBB, you are now SOLVED on 2021-02-02 09:30"

On the splunk alert menu, we didn't find for reset alert when trigger condition is no longer true. So we need a help and advice.

Thank you

Re: Alert UP and Down By Status Code

manjunathmeti — Tue, 02 Feb 2021 09:10:41 GMT

hi @bernanda ,
You can create a new field in your search and use it in the email subject/body.

<your_base_search> | eval message=if(Status_Code==200, "Hi ".Name.", you are now SOLVED on ".Time, "Hi ".Name.", you are down on ".Time)

You can use $result.message$ in the email subject/message body.

Screenshot 2021-02-02 at 2.32.34 PM.png

Change Trigger condition to trigger alert action per result.

Screenshot 2021-02-02 at 2.33.00 PM.png

If this reply helps you, an upvote/like would be appreciated.

Re: Alert UP and Down By Status Code

bernanda — Tue, 02 Feb 2021 10:01:06 GMT

Hi manjunathmeti

Thank you for your reply.

When I tried like your way, I got many alerts for the all Status with the correct message. ‌‌ That is funny to empty my inbox. but it's OK 😂

I think that is need a little conditions, just like a monitoring Uptime. If node get DOWN status then send me the a alert once. and then if the node get UP status send me the alert just once. But I still try to hard.

so, thanks for you