Alert for a Specific host Shutdown more then 5 min, Splunk send out an alert

[shakeel253]

Does anyone knows of a specific query that can used as an alert, if the host shutdown for more then 5 min, it triggers an alert and identifies user

[saurabhtcs]

Hi

You can try the below search to get alert in case any host is down for more than 5 minutes:

| tstats count latest(_time) where index=* by host
| rename earliest(_time) as earliest_time, latest(_time) as latest_time
| eval status= if(latest_time > relative_time(now(),"-5min"),"Active","Inactive")
| convert ctime(latest_time)
| search status="Inactive"
| fields - count

[shakeel253]

i want to set this query for a specific host such as host=tableau, what should i change with in the query

[somesoni2]

Add host=yourhost OR host=yourhost1 OR host=yourhost2... just after the index=* and before by host in line1.

[shakeel253]

thankyou Somesoni, that was helpful, appreciate you and saurabhtcs help 🙂

[somesoni2]

Glad we were able to you help you with your requirement. If there are not follow-up questions in same topic, do remember to close the question by accepting the answer (and upvoting it).

[shakeel253]

@somesoni2 @saurabhtcs when i used the query, if i shutdown the host, nothing comes up when i ran the query. It only shows result for last 24hrs. I started/stopped the host and ran this query but it didnt give desired result. The desire result which i want is, if the host is shutdown, the query has been setup as alert and should be able to inform user that host is shutdown or not responding with the updated timestamp

| tstats count latest(_time) where index=* host="abssvm" by host | rename earliest(_time) as earliest_time, latest(_time) as latest_time | eval status= if(latest_time > relative_time(now(),"-5min"),"Active","Inactive") | convert ctime(latest_time) | search status="Inactive" | fields - count

[saurabhtcs]

You should get an alert after 5 minutes. Since the threshold given in the search is 5mins, you will get an alert on after five minutes of the host being down (and the alert runs at that time).