Hi Splunk,
Newbie here 😅 want to ask about alert.
for example we have data like
Name | Time | StatusCode |
AAA | 2021-02-02 08:00 | 404 |
AAA | 2021-02-02 08:01 | 200 |
BBB | 2021-02-02 09:00 | 503 |
CCC | 2021-02-02 09:01 | 404 |
BBB | 2021-02-02 09:30 | 200 |
CCC | 2021-02-02 09:30 | 200 |
How to create a alert base on table with cron every per 5 minutes. if StatusCode != 200 alert notif startdown and if StatusCode =200 alert notif Solved.
Example for the alert base on table:
"Hi AAA, you are down on 2021-02-02 08:00"
and email again if the AAA StatusCode changed to 200
"Hi AAA, you are now SOLVED on 2021-02-02 08:01"
done, until the StatusCode Changed to !=200 the alert send me the email again.
Another Example:
"Hi BBB, you are down on 2021-02-02 09:00"
then the StatusCode Changed to 200
"Hi BBB, you are now SOLVED on 2021-02-02 09:30"
On the splunk alert menu, we didn't find for reset alert when trigger condition is no longer true. So we need a help and advice.
Thank you
hi @bernanda ,
You can create a new field in your search and use it in the email subject/body.
<your_base_search> | eval message=if(Status_Code==200, "Hi ".Name.", you are now SOLVED on ".Time, "Hi ".Name.", you are down on ".Time)
You can use $result.message$ in the email subject/message body.
Change Trigger condition to trigger alert action per result.
If this reply helps you, an upvote/like would be appreciated.
Hi manjunathmeti
Thank you for your reply.
When I tried like your way, I got many alerts for the all Status with the correct message. That is funny to empty my inbox. but it's OK 😂
I think that is need a little conditions, just like a monitoring Uptime. If node get DOWN status then send me the a alert once. and then if the node get UP status send me the alert just once. But I still try to hard.
so, thanks for you