Getting Data In

Change the alert action SNOW group from windows to sql team.

raghunandan1
Engager

Hi Team,

We have DB alerts for server sitpdb0033 are assigning to windows support team first , it needs to be assign to SQL team,
How to change the assignment group from windows support team to SQL team.

The index=mssql there are 30+ host's are configured. We want only change the group for this server sitpdb0033

we have using this SPL query:
index=mssql sourcetype="mssql:database" OR sourcetype="mssql:databases" state_desc!="ONLINE"

| eval assignment_group = case(like(source,"%mssql_mfg%"),"Winows_Support - Operations",1=1, "Sql_Production Support")

Can you please help on this requirement.

Thank you

Nandan

Labels (6)
Tags (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @raghunandan1 ,

You can try below;

index=mssql sourcetype="mssql:database" OR sourcetype="mssql:databases" state_desc!="ONLINE" 
| eval assignment_group = case(host=="sitpdb0033","Sql_Production Support", like(source,"%mssql_mfg%"),"Winows_Support - Operations",1=1, "Sql_Production Support")
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

raghunandan1
Engager

Thank you for your suggestions,

As per your suggestions we have changed the SQL quiry. After changes results showing it's still "Winows_Support - Operations" group. 

Can you please help me here.

0 Karma

raghunandan1
Engager

As per your suggestions we have changed the SQL quiry. After changes results showing it's still "Winows_Support - Operations" group. 

Can you please help me here.

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...