Pausing a single forwarder?

[JRG_Jeff]

Hi there!

I have a server that will be down for sometime, and I would like to not be inundated with "missing forwarder" alerts.  Is there a way to "pause" that alert for just that server?

Thanks in advance!

[richgalloway]

There is no built-in way to do that with core Splunk.  You have to modify the alert to ignore the forwarder.  When maintenance is over, remember to revert the alert. 

Consider having the alert consult a lookup file of servers to ignore.  Then you just have to update the file when a server is going to be unavailable.

[gcusello]

Hi @JRG_Jeff,

you could insert in your missing forwarder alert a lookup to whitelist the forwarder to check or to blacklist the forwarders to not check.

In other words, if the liste of the forwarders to check is in a lookup called parameter.csv, you could use a search like this:

| metasearch index=_internale
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

in this way you check only the forwarders in perimeter and to avoid an alert for in maintenance forwarder, you can temporary delete it from the lookup.

Otherwise, you could create a blacklist lookup (called e.g. blacklisted_forwarders.csv9 and run something like this:

| metasearch index=_internale NOT [ | inputlookup blacklisted_forwarders.csv | fields host ]
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

Ciao.

Giuseppe