Alerting

Splunk Alert Creation for threshhold monitoring ?

bapun18
Communicator

Hi Friends ,

I want to create an alert for my Hadoop Job Monitoring and trigger an alert mail to team notifying or hihglighting only for jobs which has been running for more than 90mins based on which action can be taken.I am attaching the screenshot of my query .Please help me in modifying and fine tuning the query changes if needed. Before i proceed to set an alert for monitoring .alt text

Tags (2)
0 Karma

to4kawa
Ultra Champion
index=hadoopmon_db sourcetype=cm_yarn_metrics_live finalStatus=UNDEFINED elapsedTime > 5400 earliet=-90m@m latest=now 

To alert, if there is more than one result.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@bapun18

Below are my suggestions for your scenario. As per your requirement, you want a jobs which has been running for more than 90mins, so for this 1) you can filter event in search also. 2) You have to set threshold on id field for specific period. It will helps you to restrict alert flooding for single id.

Check below links for Alert Configurations:

https://docs.splunk.com/Documentation/Splunk/8.0.0/DMC/Platformalerts#Configure_platform_alerts_and_...

https://docs.splunk.com/Documentation/Splunk/8.0.0/Alert/Aboutalerts

https://docs.splunk.com/Documentation/Splunk/8.0.0/Alert/ThrottleAlerts

Alert scheduling tips: https://docs.splunk.com/Documentation/Splunk/8.0.0/Alert/AlertSchedulingBestPractices

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...