Alerting

splunk time problem

aalaa
Path Finder

Hello ,

We have a problem between the time of the splunk and the time of the events cisco probably :

We create a real-time alert about changing the status of switches or routers interfaces.

Based on dashboards at the Cisco Network application :

Search = "sourcetype =" cisco: ios "src_int! =" "Host =" * "| stats count by _time, host, src_int, port_status | where port_status =" up "OR port_status =" down "

We create this alert to send each email the port status change from "UP to down" or "down to UP" in real time.

I have tested several times changing the status of a switch interface but i don't receive any triggered alert , according to the support analysis we observed that the problem is in the difference between the time of the splunk and the time of the events cisco not in the configuration of the alert .

Lastes event cisco : 10:03
Time splunk : 09:03

So any help please ?

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi aalaa,
probably there's a timezone problem: on cisto you have summer time and not in Splunk, you havew to adjust the timezones.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...