Getting Data In

Change the alert action SNOW group from windows to sql team.

raghunandan1
Engager

Hi Team,

We have DB alerts for server sitpdb0033 are assigning to windows support team first , it needs to be assign to SQL team,
How to change the assignment group from windows support team to SQL team.

The index=mssql there are 30+ host's are configured. We want only change the group for this server sitpdb0033

we have using this SPL query:
index=mssql sourcetype="mssql:database" OR sourcetype="mssql:databases" state_desc!="ONLINE"

| eval assignment_group = case(like(source,"%mssql_mfg%"),"Winows_Support - Operations",1=1, "Sql_Production Support")

Can you please help on this requirement.

Thank you

Nandan

Labels (6)
Tags (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @raghunandan1 ,

You can try below;

index=mssql sourcetype="mssql:database" OR sourcetype="mssql:databases" state_desc!="ONLINE" 
| eval assignment_group = case(host=="sitpdb0033","Sql_Production Support", like(source,"%mssql_mfg%"),"Winows_Support - Operations",1=1, "Sql_Production Support")
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

raghunandan1
Engager

Thank you for your suggestions,

As per your suggestions we have changed the SQL quiry. After changes results showing it's still "Winows_Support - Operations" group. 

Can you please help me here.

0 Karma

raghunandan1
Engager

As per your suggestions we have changed the SQL quiry. After changes results showing it's still "Winows_Support - Operations" group. 

Can you please help me here.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...