Alerting

Pausing a single forwarder?

JRG_Jeff
Engager

Hi there!

I have a server that will be down for sometime, and I would like to not be inundated with "missing forwarder" alerts.  Is there a way to "pause" that alert for just that server?

 

Thanks in advance!

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no built-in way to do that with core Splunk.  You have to modify the alert to ignore the forwarder.  When maintenance is over, remember to revert the alert. 

Consider having the alert consult a lookup file of servers to ignore.  Then you just have to update the file when a server is going to be unavailable.

---
If this reply helps you, Karma would be appreciated.

gcusello
Esteemed Legend

Hi @JRG_Jeff,

you could insert in your missing forwarder alert a lookup to whitelist the forwarder to check or to blacklist the forwarders to not check.

In other words, if the liste of the forwarders to check is in a lookup called parameter.csv, you could use a search like this:

| metasearch index=_internale
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

in this way you check only the forwarders in perimeter and to avoid an alert for in maintenance forwarder, you can temporary delete it from the lookup.

Otherwise, you could create a blacklist lookup (called e.g. blacklisted_forwarders.csv9 and run something like this:

| metasearch index=_internale NOT [ | inputlookup blacklisted_forwarders.csv | fields host ]
| eval host=lower(host)
| stats count BY host
| append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ]
| stats sum(count) AS total BY host
| where total=0

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...