Getting Data In
Highlighted

indexing triage

Communicator

how can I skip alerts when indexing is stopped or indexers are stopped or indexing latency is more than 15min

0 Karma
Highlighted

Re: indexing triage

Contributor

what is the use case and can you elaborate?

0 Karma
Highlighted

Re: indexing triage

Communicator

I set up an alert, looks for the last 15 min data for every 15 min.
I have a list of hosts in the lookup table, when the hosts in the lookup table is not reporting sends and an email alert. When indexing is stopped, or indexers are stopped, or indexing latency is more than 15min I am receiving alert for every host.
I want to stop receiving alerts when environmental issue occurred
|inputlooup host.csv | join host type=left [search index=* [|inputlooup host.csv]| stats count by host ] | fillnull value=0 | where count=0
I have a query something like this

0 Karma