Alerting

How to create an Alert when ping UP and DOWN?

jack1
Loves-to-Learn Everything

My i know how to set ping how many times fail or success , then only it will send alert?

Currently I was told tht it only ping 1 time in 5mins, then it will send out alert if DOWN. which I think 1 time ping is too short to conclude the IP is DOWN. I wanted to change it to 5 times ping , if 100% only consider IP is DOWN. May I know how to do it ?

 Network State Change Rule.png

Labels (1)
0 Karma

jack1
Loves-to-Learn Everything

Hi, 

I dont understand. you mean add this 2 cmd after existing one? or how shld it be?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Start with a search which finds when you have at least 5 consecutive down flags

| streamstats count reset_on_change=true by flag
| where flag="DOWN" AND count>=5
0 Karma

jack1
Loves-to-Learn Everything

Is it like this?

 

jack1_0-1655038082016.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Start with

index=ping
| eval flag=if(packet_loss=100,"DOWN","UP")
| streamstats count reset+on_change=true by flag
| where count >= 5 AND flag="DOWN"
0 Karma

jack1
Loves-to-Learn Everything

Sorry i nvr do splunk before.  where do i start copy the line frm current alert settings? so tht I will know which branch is DOWN , at wht date/time, with the comments as well.something like below. All info is frm the lookup file.

 WAN Site: Palo Alto US Cct:11654483  

16 Jun 2022 17:04:40 - WAN UP

May I knw how to link this to the lookup file? It has all the IP and branch name, location, cct id, etc.

Currently the ping is set to 5 (original is 1), interval=300s but thereafter only received UP but no DOWN alert  

 

jack1_2-1655379486224.jpeg

May i also knw how shld the time range and cron expression be configured for every 300s(5 ping)?

jack1_3-1655379636334.png

 

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...