All Apps and Add-ons

How does mark hosts as down work?



can you describe shortly how this TA works and how i can use it properly?

0 Karma


It looks as if this TA is using macros to populate a lookup. So an example to mark a host "down" might go something like this ( = backtick):

earliest=-1m@m sourcetype=iis http_status=500 | stats count by host | where count > 200 | map search="<BT>mark_host_down($host$)<BT>"

Basically, you can funnel any string and have it populate a lookup with either up or down status.
Once you have the host marked, you can use the lookup to write reports.

earliest=-20m@m sourcetype=iis [|inputcsv server_down | rename server_name as host]| stats count by host

This will show you what servers are down, and their events.

To clarify: I did NOT write the TA, nor would I recommend its use. After looking at the code, it seems kinda "hackish" and doesn't use optimizations, provide much useful data enrichment other than "the server name is down" lookup, and does not follow Developing Apps Best practices (it has stuff in the local folder.....). Use at your own risk, but you might be better off writing something else that has more data enrichment (the server name with status [hardware down, software down, etc], first seen down, last seen down, resolved time, etc).

0 Karma


Hi alacercogitatus, thanks for your feedback. It was indeed just a simple try to get an option to quiet out alerts for host with known problems. Data enrichment was not needed in this case, but could be added to the next release.....

Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...