How to query for alert if the device is down and no up stage log is received in 15 minutes?

[Mohanveera1]

Hello Splunkers,

I am trying to create an alert when the log with "UP" state is not received within 15 minutes from the time of "DOWN" state log received. So can anyone help me out...

Scenario:

When the device is Down the splunk will receive the log from solar-winds that the device is "DOWN" along with the host name in the log. So if the splunk doesn't receive the log that containing the "UP" state from the solar-winds in the next 15 minutes then an alert must be raised.

So can anyone help me to create an Query for the alert for the above scenario.

Thanks in Advance....

[gcusello · Accepted solution]

Hi @Mohanveera1 ,

please see my approach and adapt it to your real search:

index=your_index (status="UP" OT status="DOWN") earliest=-30m@m latest=@m
| transaction host startswith=UP endswith=DOWN
| where duration>900

Ciao.

Giuseppe