how to create a script command in a ksh

riotto — Fri, 15 Jan 2021 15:05:43 GMT

Hello,

I have some alerts that send an email with the events to me if triggered. I need to create a custom script for the alerts that check if that splunk indexer is the indexer that should be is receiving events from our application logs.

Our application can run in two cities but only one city is active. We actually failover if necessary to the other city, so the splunk indexer in that city only will receive events from the application logs. I cannot keep alerts from both indexers active, so the standby city needs to have all its alerts disabled. We failover manually which causes us to manually disable alerts on indexer in the city we are switching from and enable the alerts in the city we are switching to. I need to all the alerts enabled at both cities all the time. I need the alerts to do an nslookup of the IP that is active for the application and if that IP is on that indexer's side then the alert is valid and should email the events to me. If the IP is not on that indexer's side, the alert is a false positive and nothing needs to get emailed. Any help is appreciated

Re: how to create a script command in a ksh

scelikok — Fri, 15 Jan 2021 20:34:56 GMT

Hi @riotto,

You can lookup ip address to filter alert result in your alert search like below;

**As an example activeidx.acme.com resolves 10.1.1.1 which is current indexer. You should put its own resolved ip address in each city indexer. | your search for alert append [| makeresults | eval idx_fqdn="activeidx.acme.com" | lookup dnslookup clienthost as idx_fqdn OUTPUT clientip | fields clientip ] | eventstats latest(clientip) as my_ip | where my_ip="10.1.1.1"

If this reply helps you an upvote is appreciated.

topic how to create a script command in a ksh in Splunk Search

how to create a script command in a ksh

Re: how to create a script command in a ksh