Alerting

How to trigger an alert to send an email only when the same hosts fails more than once ?

ReachDataScient
Explorer

I have the splunk alert scheduled to run every 5 min to trigger an email to report if any splunk search peer hosts are down.

| rest splunk_server=local / services/search/distributed/peers/
| where status!="Up" AND disabled=0
| fields peerName, status | rename peerName as Instance, status as Status

I want the alert to trigger to send an email only when the same hosts fails more than once as there seems many false positive.
How to achieve this?

0 Karma

maureend_splunk
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...