Alerting

How do I alert on a field if service changed from up to down?

DanielASG
Explorer

Hi all

We are watching 44 critical items in Splunk, and we have a search running to let us know if the service is up or down.

> index="winevents_server" sourcetype=updown | lookup updownhosts.csv IP OUTPUT Device_name,Use,Model | dedup IP | rename stats as status |table _time,IP Device_name, Model, status
> Blockquote

how can we alert if any of the values change from up to down or down to up ?

i know how to alert on each one, but I did not want 44 searches running at once. is there a way of doing this with one search?

Tags (3)
0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Something like this might work.

index="scratchpad" sourcetype="downtoup" 
| dedup status consecutive=true 
| head 2 
| stats count 
| where count=2

The consecutive parameter for the dedup command will dedup until the value changes, then dedup again. I tested with the value changing 4 times and I ended up with 4 events, even though I had more. Using head 2 gives you the last 2 values within the time window you are searching in. If the count is 2, it would indicate that the status has changed in that time window.

View solution in original post

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Something like this might work.

index="scratchpad" sourcetype="downtoup" 
| dedup status consecutive=true 
| head 2 
| stats count 
| where count=2

The consecutive parameter for the dedup command will dedup until the value changes, then dedup again. I tested with the value changing 4 times and I ended up with 4 events, even though I had more. Using head 2 gives you the last 2 values within the time window you are searching in. If the count is 2, it would indicate that the status has changed in that time window.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...