All Apps and Add-ons

How does mark hosts as down work?

kaddupa1
Explorer

Hi,

can you describe shortly how this TA works and how i can use it properly?
thanks.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

It looks as if this TA is using macros to populate a lookup. So an example to mark a host "down" might go something like this ( = backtick):

earliest=-1m@m sourcetype=iis http_status=500 | stats count by host | where count > 200 | map search="<BT>mark_host_down($host$)<BT>"

Basically, you can funnel any string and have it populate a lookup with either up or down status.
Once you have the host marked, you can use the lookup to write reports.

earliest=-20m@m sourcetype=iis [|inputcsv server_down | rename server_name as host]| stats count by host

This will show you what servers are down, and their events.

To clarify: I did NOT write the TA, nor would I recommend its use. After looking at the code, it seems kinda "hackish" and doesn't use optimizations, provide much useful data enrichment other than "the server name is down" lookup, and does not follow Developing Apps Best practices (it has stuff in the local folder.....). Use at your own risk, but you might be better off writing something else that has more data enrichment (the server name with status [hardware down, software down, etc], first seen down, last seen down, resolved time, etc).

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi alacercogitatus, thanks for your feedback. It was indeed just a simple try to get an option to quiet out alerts for host with known problems. Data enrichment was not needed in this case, but could be added to the next release.....

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!