Alerting

Is there a way i can create custom notification triggers in Splunk?

sabdulkader
New Member

Is there a way i can create custom notification triggers in Splunk?

For example, if a restart of the server is initiated or a software is installed on the servers etc.

And it would send an email automatically informing the same. Please help

Thanks & Regards,
Siraj

0 Karma
1 Solution

victor_menezes
Explorer

Hi,
I believe you could create a query to the sourcetype=Wineventlog looking for an event that would represent a system reboot information. The event id 6006 tells you that event log service was shut down, which may represent a server reboot. For installed applications, the event id 11707 is for MsiInstaller and may help you to identify some.

With that query in hands and tested, just save it as an alert and set it as you wish, configuring the trigger action to send you a mail.

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @sabdulkader

Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

victor_menezes
Explorer

Hi,
I believe you could create a query to the sourcetype=Wineventlog looking for an event that would represent a system reboot information. The event id 6006 tells you that event log service was shut down, which may represent a server reboot. For installed applications, the event id 11707 is for MsiInstaller and may help you to identify some.

With that query in hands and tested, just save it as an alert and set it as you wish, configuring the trigger action to send you a mail.

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!