Alerting

Creating an alert that mointors specific entries of an index compared to entire index

pdreef
Explorer

index=dart_index source=DMZ_IncomingOutgoing status_message="OK" earliest=-48h@h
| eval DeliveryComplete=strptime(delivery_complete, "%Y-%m-%d %H:%M:%S")
| stats values(src_host) as Source, values(dest_host) as Destination, values(login_name) as DataOwner, values(host_name) as DartNode, values(xfer_type) as XferMethod, min(DeliveryComplete) as EarliestFileXfer, max(DeliveryComplete) as LastFileXfer by subscription_name
| where now()>relative_time(LastFileXfer, "+24h@h")
| eval DaysOld=round((now() - round(LastFileXfer, 0))/86400, 2)
| eval EarliestFileXfer=strftime(EarliestFileXfer, "%Y-%m-%d %H:%M:%S")
| eval LastFileXfer=strftime(LastFileXfer, "%Y-%m-%d %H:%M:%S")
| table subscription_name Source Destination DataOwner DartNode XferMethod EarliestFileXfer LastFileXfer DaysOld

 

I have search that was created by a previous developer and it searches the entire index labeled " subscription_name" The problem is we only want to monitor a certain number of subscrption compared to the entire table of subscription in our DB.

 

 

Labels (2)
0 Karma
1 Solution

scelikok
Champion

Hi @pdreef, I believe you want to filter some subscription names. If so, please try below;

 

index=dart_index source=DMZ_IncomingOutgoing status_message="OK"  subscription_name IN ("subs_A","subs_B","subs_C") earliest=-48h@h
| eval DeliveryComplete=strptime(delivery_complete, "%Y-%m-%d %H:%M:%S")
| stats values(src_host) as Source, values(dest_host) as Destination, values(login_name) as DataOwner, values(host_name) as DartNode, values(xfer_type) as XferMethod, min(DeliveryComplete) as EarliestFileXfer, max(DeliveryComplete) as LastFileXfer by subscription_name
| where now()>relative_time(LastFileXfer, "+24h@h")
| eval DaysOld=round((now() - round(LastFileXfer, 0))/86400, 2)
| eval EarliestFileXfer=strftime(EarliestFileXfer, "%Y-%m-%d %H:%M:%S")
| eval LastFileXfer=strftime(LastFileXfer, "%Y-%m-%d %H:%M:%S")
| table subscription_name Source Destination DataOwner DartNode XferMethod EarliestFileXfer LastFileXfer DaysOld

 

 You can put your subscription_names to be monitored inside IN () block.

 

If this reply helps you an upvote is appreciated. 

If this reply helps you an upvote is appreciated.

View solution in original post

pdreef
Explorer

Thanks for the help and assistance. 

 

The solution is as follows,

Subscription_name OUT (" sub_A | sub_B")

 

 

0 Karma

scelikok
Champion

Hi @pdreef, I believe you want to filter some subscription names. If so, please try below;

 

index=dart_index source=DMZ_IncomingOutgoing status_message="OK"  subscription_name IN ("subs_A","subs_B","subs_C") earliest=-48h@h
| eval DeliveryComplete=strptime(delivery_complete, "%Y-%m-%d %H:%M:%S")
| stats values(src_host) as Source, values(dest_host) as Destination, values(login_name) as DataOwner, values(host_name) as DartNode, values(xfer_type) as XferMethod, min(DeliveryComplete) as EarliestFileXfer, max(DeliveryComplete) as LastFileXfer by subscription_name
| where now()>relative_time(LastFileXfer, "+24h@h")
| eval DaysOld=round((now() - round(LastFileXfer, 0))/86400, 2)
| eval EarliestFileXfer=strftime(EarliestFileXfer, "%Y-%m-%d %H:%M:%S")
| eval LastFileXfer=strftime(LastFileXfer, "%Y-%m-%d %H:%M:%S")
| table subscription_name Source Destination DataOwner DartNode XferMethod EarliestFileXfer LastFileXfer DaysOld

 

 You can put your subscription_names to be monitored inside IN () block.

 

If this reply helps you an upvote is appreciated. 

If this reply helps you an upvote is appreciated.

View solution in original post

pdreef
Explorer

Yes, this worked.! I imagine you can use an OUT for entries you do not want to see in your alert. I will play around and see if that is possible. Thank you for taking the time to help me and my team. 

0 Karma

scelikok
Champion

@pdreef, great to know it works. 

There is no OUT function, you can use NOT IN () to filter the entries you do not want to see in your alert.

Best Regards

If this reply helps you an upvote is appreciated.
0 Karma

pdreef
Explorer

The NOT IN () did not work in the search, was given the error code below.

 

Error in 'search' command: Unable to parse the search: Comparator 'IN' has an invalid term on the left hand side: NOT.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.