Alerting

How to trigger an alert to send an email only when the same hosts fails more than once ?

ReachDataScient
Explorer

I have the splunk alert scheduled to run every 5 min to trigger an email to report if any splunk search peer hosts are down.

| rest splunk_server=local / services/search/distributed/peers/
| where status!="Up" AND disabled=0
| fields peerName, status | rename peerName as Instance, status as Status

I want the alert to trigger to send an email only when the same hosts fails more than once as there seems many false positive.
How to achieve this?

0 Karma

maureend_splunk
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...