Dashboards & Visualizations

Alert UP and Down By Status Code

bernanda
Explorer

Hi Splunk,

Newbie here 😅 want to ask about alert.

for example we have data like

NameTimeStatusCode
AAA2021-02-02 08:00404
AAA2021-02-02 08:01200
BBB2021-02-02 09:00503
CCC2021-02-02 09:01404
BBB2021-02-02 09:30200
CCC2021-02-02 09:30200


How to create a alert base on table with cron every per 5 minutes. if StatusCode != 200 alert notif startdown and if StatusCode =200 alert notif Solved.

 

Example for the alert base on table:

"Hi AAA, you are down on 2021-02-02 08:00"

and email again if the AAA StatusCode changed to 200

"Hi AAA, you are now SOLVED on 2021-02-02 08:01"

done, until the StatusCode Changed to !=200 the alert send me the email again.

 

Another Example:

"Hi BBB, you are down on 2021-02-02 09:00"

then the StatusCode Changed to 200

"Hi BBB, you are now SOLVED on 2021-02-02 09:30"

 

On the splunk alert menu, we didn't find  for reset alert when trigger condition is no longer true. So we need a help and advice.

 

Thank you  

Labels (2)
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @bernanda ,
You can create a new field in your search and use it in the email subject/body.

 

<your_base_search> | eval message=if(Status_Code==200, "Hi ".Name.", you are now SOLVED on ".Time, "Hi ".Name.", you are down on ".Time)

 

You can use $result.message$ in the email subject/message body. 

Screenshot 2021-02-02 at 2.32.34 PM.png

Change Trigger condition to trigger alert action per result. 

Screenshot 2021-02-02 at 2.33.00 PM.png

If this reply helps you, an upvote/like would be appreciated.

0 Karma

bernanda
Explorer

Hi manjunathmeti

Thank you for your reply.

When I tried like your way, I got many alerts for the all Status with the correct message. ‌‌ That is funny to empty my inbox. but it's OK 😂

I think that is need a little conditions, just like a monitoring Uptime. If node get DOWN status then send me the a alert once. and then if the node get UP status send me the alert just once. But I still try to hard.

so, thanks for you

 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...