Splunk AppDynamics

Alert correlation and fine tuning to reduce the noise

nvnbsibm
New Member

Hi,

We have implemented service now Integration with APPDynamics with service and we see lot of noise for the alert that are getting generated and we want to fine tune it and is there any best practices for the same which talks about correlation and finetuning to reduce the same

Labels (3)
Tags (1)
0 Karma

Mark_Byrne
Path Finder

Hiya,

What are your trigger conditions for the rule? Are they a simple count, or deviation from baseline? If so, you could try setting the rule to look for multiple occurrences in the last 30 minutes.

We've found this can substantially reduce the violations created by single spikes.

The process I go through for this is to look at each event, examine the data points in the metric browser that caused the event to trigger, and determine whether it was a true or false positive. From there I try to figure out a rule that wouldn't be triggered by the false positive. It can be a very iterative process....

Mark

iamryan
Community Manager
Community Manager

Hi @V N Bhavanishankar.N,

We have a Knowledge base article, How do I use AppDynamics with ServiceNow? 

Please check it out and let me know if it helped! If you learn anything, please do share those learnings back as a reply to this post. Knowledge sharing is what drives this community forward. 

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...