All Apps and Add-ons

Website Monitoring: How to assign email recipients for outage alerts?

sj0man
Engager

Hi,
I have a question.

There is a description in documentation of 'Website Monitoring' app.
Email Outage Alerting: get an emailed alert when your website is down (responds too slowly or is returning an error)
How to assign receivers of emailed alert?

TIA

0 Karma
1 Solution

LukeMurphey
Champion

Here are directions on how to set this up.

Step 1: Splunk Configuration
You will need to configure Splunk to work with an email server. To set this up, go the Splunk Manager at Server settings » Email settings.

Step 2: Configuring the Search
The app includes a search named "website_performance_problems" that works well for email alerting. To configure it for email alerting, open the "website_performance_problems" search in the Manager (Manager » "Searches, reports, and alerts"). Click the checkbox next to "Send email" alert action to enable it and complete the information necessary to use the alert action.

Step 3: Customizing Response Time Threshold (optional)
You may want to change the threshold that is used to determine if a site has been down too long. To do so, edit the "response_time_threshold" macro. You can change the macro in the Manager by going to "Advanced search" » "Search macros" and editing the "response_time_threshold" macro.

Step 4: Filtering Out Sites (optional)
You may want not want to receive email notifications for some sites. To filter these sites out, add a where clause to the "website_performance_problems" search just after the first search part. Below is an example of a search using where clauses to filter out some sites:

sourcetype="web_ping" (response_code>=400 OR timed_out=True) OR (total_time>`response_time_threshold` NOT (title="LukeMurphey.net") ) | where NOT like(url,"%splunk.com%") | fillnull response_code value="Connection failed" | eval response_code=if(timed_out == "True", "Connection timed out", response_code) | stats count as count max(total_time) as max_total_time by title url response_code | eval max_total_time=round(max_total_time, 2)." ms" 

View solution in original post

LukeMurphey
Champion

Here are directions on how to set this up.

Step 1: Splunk Configuration
You will need to configure Splunk to work with an email server. To set this up, go the Splunk Manager at Server settings » Email settings.

Step 2: Configuring the Search
The app includes a search named "website_performance_problems" that works well for email alerting. To configure it for email alerting, open the "website_performance_problems" search in the Manager (Manager » "Searches, reports, and alerts"). Click the checkbox next to "Send email" alert action to enable it and complete the information necessary to use the alert action.

Step 3: Customizing Response Time Threshold (optional)
You may want to change the threshold that is used to determine if a site has been down too long. To do so, edit the "response_time_threshold" macro. You can change the macro in the Manager by going to "Advanced search" » "Search macros" and editing the "response_time_threshold" macro.

Step 4: Filtering Out Sites (optional)
You may want not want to receive email notifications for some sites. To filter these sites out, add a where clause to the "website_performance_problems" search just after the first search part. Below is an example of a search using where clauses to filter out some sites:

sourcetype="web_ping" (response_code>=400 OR timed_out=True) OR (total_time>`response_time_threshold` NOT (title="LukeMurphey.net") ) | where NOT like(url,"%splunk.com%") | fillnull response_code value="Connection failed" | eval response_code=if(timed_out == "True", "Connection timed out", response_code) | stats count as count max(total_time) as max_total_time by title url response_code | eval max_total_time=round(max_total_time, 2)." ms" 

MichaelPriest
Communicator

When you create the alert you can input the receivers for emails, read about alerts here:

http://docs.splunk.com/Documentation/Splunk/6.2.3/alert/Aboutalerts

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...