Alerting

How to query for alert if the device is down and no up stage log is received in 15 minutes?

Mohanveera1
Explorer

Hello Splunkers,

I am trying to create an alert when the log with "UP" state is not received within 15 minutes from the time of "DOWN" state log received. So can anyone help me out...

Scenario:

When the device is Down the splunk will receive the log from solar-winds that the device is "DOWN" along with the host name in the log. So if the splunk doesn't receive the log that containing the "UP" state from the solar-winds in the next 15 minutes then an alert must be raised.

So can anyone help me to create an Query for the alert for the above scenario.

Thanks in Advance....

Labels (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Mohanveera1 ,

please see my approach and adapt it to your real search:

index=your_index (status="UP" OT status="DOWN") earliest=-30m@m latest=@m
| transaction host startswith=UP endswith=DOWN
| where duration>900

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Mohanveera1 ,

please see my approach and adapt it to your real search:

index=your_index (status="UP" OT status="DOWN") earliest=-30m@m latest=@m
| transaction host startswith=UP endswith=DOWN
| where duration>900

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...