Splunk AppDynamics

Health rule based on application changes

CommunityUser
Splunk Employee
Splunk Employee

I would like to create a health rule that is based on application changes. For instance, a rule that is violated when the app server of a specific node has been restarted more than x times within a specified time range. It seems that this value is not considered as a metric and therefore cannot be referenced in the health rule violation wizard. Am i missing something here or is this simply not supported?

Labels (3)
0 Karma
1 Solution

CommunityUser
Splunk Employee
Splunk Employee

I am not sure what is the intent of the health rule, if it is to check at what times the app went down then you can use the following.

Overall Application Performance > Agent > App > Availability, 

At the tier level, the value of the above metric is equal to total number of nodes reporting to the tier, at the node level, the value of the above metric will always be one.

Perhaps you can use the sum of the metircs over a period of time and check against your threshold?

To your original question, i dont think number of restarts is saved any where.

May be you can write a shell script to find that out on your server and then use extensions to report that value as a custom metric?

Cheers,

Gurmit.

View solution in original post

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

I am not sure what is the intent of the health rule, if it is to check at what times the app went down then you can use the following.

Overall Application Performance > Agent > App > Availability, 

At the tier level, the value of the above metric is equal to total number of nodes reporting to the tier, at the node level, the value of the above metric will always be one.

Perhaps you can use the sum of the metircs over a period of time and check against your threshold?

To your original question, i dont think number of restarts is saved any where.

May be you can write a shell script to find that out on your server and then use extensions to report that value as a custom metric?

Cheers,

Gurmit.

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Hi Gurmit,

The intent of the rule is to easily detect if an application is recycling frequently, as this may indicate that a private memory limit for instance, is exceeded easily. I suppose checking the availabilty of a tier could also cover this in some way. I will try this first. Thanks for the quick reply!

Regards,

Simon

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...