Alerting
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Need query to ignore/correlate Down and Up events which are in 2 min interval.

keshavgupta
Engager
‎04-22-2021 11:44 PM

Need query to ignore Down and Up events which are in 2 min interval. Is it possible to throttle/trigger with multiple fields/value .

For ex : we have 3 fields called Time, Device Name and AlertGroup

1st alert : Time : 08:00:00, Device Name is ABC and AlertGroup is Down

2nd alert : Time : 08:00:55, Device Name is XYZ and AlertGroup is Down

3rd alert : Time : 08:01:00, Device Name is ABC and AlertGroup is Up

4th alert : Time : 08:07:00, , Device Name is XYZ and AlertGroup is Up

Now in this situation i dont want to trigger an alert/notification if we are receiving the alert with same device name with Down and Up with in 2 mins window. So if we compare with above ex: in this case 1st alert and 3rd alert should get ignored because its got correlated with in 2 min itself. Please help me to build this search query

Labels (3)
0 Karma
Reply
Register for .conf25!
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...