Alerting

Set up alert when service is restored

3DGjos
Communicator

Hello, i'm making alerts for a client, we need 2 alerts, one of them was very easy to make:

Running on cron schedule every 5 minutes, alert if mybasesearch: "index=myindex errorcode=0" returns more than 20 results. The problem is with the second one, they want Splunk to alert when there are no more errorcode=0's on the search.

So what I have in mind is to make a query which compares T1=(-5 to -10 mins ago) and T2=(now() to -5 mins ago) and eval

IF isnull(T1) and isnull(T2) => do nothing
IF isnotnull(T1) and isnotnull(T2) => do nothing
IF isnull(T1) and isnotnull(T1) => do nothing, becase we have alert 1 for this
IF isnotnull(T1) and isnull(T2) => ALERT EVERYTHING IS OK AGAIN!

can you help me to translate this logic to SPL? Im thinking about relative time but I don't know how to do it. the best BEST would be to put everything in just 1 alert, but 2 alerts are fine too,

Thanks!

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...