Dashboards & Visualizations

Alert UP and Down By Status Code

bernanda
Explorer

Hi Splunk,

Newbie here 😅 want to ask about alert.

for example we have data like

NameTimeStatusCode
AAA2021-02-02 08:00404
AAA2021-02-02 08:01200
BBB2021-02-02 09:00503
CCC2021-02-02 09:01404
BBB2021-02-02 09:30200
CCC2021-02-02 09:30200


How to create a alert base on table with cron every per 5 minutes. if StatusCode != 200 alert notif startdown and if StatusCode =200 alert notif Solved.

 

Example for the alert base on table:

"Hi AAA, you are down on 2021-02-02 08:00"

and email again if the AAA StatusCode changed to 200

"Hi AAA, you are now SOLVED on 2021-02-02 08:01"

done, until the StatusCode Changed to !=200 the alert send me the email again.

 

Another Example:

"Hi BBB, you are down on 2021-02-02 09:00"

then the StatusCode Changed to 200

"Hi BBB, you are now SOLVED on 2021-02-02 09:30"

 

On the splunk alert menu, we didn't find  for reset alert when trigger condition is no longer true. So we need a help and advice.

 

Thank you  

Labels (2)
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @bernanda ,
You can create a new field in your search and use it in the email subject/body.

 

<your_base_search> | eval message=if(Status_Code==200, "Hi ".Name.", you are now SOLVED on ".Time, "Hi ".Name.", you are down on ".Time)

 

You can use $result.message$ in the email subject/message body. 

Screenshot 2021-02-02 at 2.32.34 PM.png

Change Trigger condition to trigger alert action per result. 

Screenshot 2021-02-02 at 2.33.00 PM.png

If this reply helps you, an upvote/like would be appreciated.

0 Karma

bernanda
Explorer

Hi manjunathmeti

Thank you for your reply.

When I tried like your way, I got many alerts for the all Status with the correct message. ‌‌ That is funny to empty my inbox. but it's OK 😂

I think that is need a little conditions, just like a monitoring Uptime. If node get DOWN status then send me the a alert once. and then if the node get UP status send me the alert just once. But I still try to hard.

so, thanks for you

 

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...