Splunk AppDynamics

Health rule based on application changes

CommunityUser
Splunk Employee
Splunk Employee

I would like to create a health rule that is based on application changes. For instance, a rule that is violated when the app server of a specific node has been restarted more than x times within a specified time range. It seems that this value is not considered as a metric and therefore cannot be referenced in the health rule violation wizard. Am i missing something here or is this simply not supported?

Labels (3)
0 Karma
1 Solution

CommunityUser
Splunk Employee
Splunk Employee

I am not sure what is the intent of the health rule, if it is to check at what times the app went down then you can use the following.

Overall Application Performance > Agent > App > Availability, 

At the tier level, the value of the above metric is equal to total number of nodes reporting to the tier, at the node level, the value of the above metric will always be one.

Perhaps you can use the sum of the metircs over a period of time and check against your threshold?

To your original question, i dont think number of restarts is saved any where.

May be you can write a shell script to find that out on your server and then use extensions to report that value as a custom metric?

Cheers,

Gurmit.

View solution in original post

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

I am not sure what is the intent of the health rule, if it is to check at what times the app went down then you can use the following.

Overall Application Performance > Agent > App > Availability, 

At the tier level, the value of the above metric is equal to total number of nodes reporting to the tier, at the node level, the value of the above metric will always be one.

Perhaps you can use the sum of the metircs over a period of time and check against your threshold?

To your original question, i dont think number of restarts is saved any where.

May be you can write a shell script to find that out on your server and then use extensions to report that value as a custom metric?

Cheers,

Gurmit.

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Hi Gurmit,

The intent of the rule is to easily detect if an application is recycling frequently, as this may indicate that a private memory limit for instance, is exceeded easily. I suppose checking the availabilty of a tier could also cover this in some way. I will try this first. Thanks for the quick reply!

Regards,

Simon

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...