Splunk AppDynamics

Health rule based on application changes

CommunityUser
Splunk Employee
Splunk Employee

I would like to create a health rule that is based on application changes. For instance, a rule that is violated when the app server of a specific node has been restarted more than x times within a specified time range. It seems that this value is not considered as a metric and therefore cannot be referenced in the health rule violation wizard. Am i missing something here or is this simply not supported?

Labels (3)
0 Karma
1 Solution

CommunityUser
Splunk Employee
Splunk Employee

I am not sure what is the intent of the health rule, if it is to check at what times the app went down then you can use the following.

Overall Application Performance > Agent > App > Availability, 

At the tier level, the value of the above metric is equal to total number of nodes reporting to the tier, at the node level, the value of the above metric will always be one.

Perhaps you can use the sum of the metircs over a period of time and check against your threshold?

To your original question, i dont think number of restarts is saved any where.

May be you can write a shell script to find that out on your server and then use extensions to report that value as a custom metric?

Cheers,

Gurmit.

View solution in original post

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

I am not sure what is the intent of the health rule, if it is to check at what times the app went down then you can use the following.

Overall Application Performance > Agent > App > Availability, 

At the tier level, the value of the above metric is equal to total number of nodes reporting to the tier, at the node level, the value of the above metric will always be one.

Perhaps you can use the sum of the metircs over a period of time and check against your threshold?

To your original question, i dont think number of restarts is saved any where.

May be you can write a shell script to find that out on your server and then use extensions to report that value as a custom metric?

Cheers,

Gurmit.

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Hi Gurmit,

The intent of the rule is to easily detect if an application is recycling frequently, as this may indicate that a private memory limit for instance, is exceeded easily. I suppose checking the availabilty of a tier could also cover this in some way. I will try this first. Thanks for the quick reply!

Regards,

Simon

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Splunk Developer Day announcements: AI agents, MCP tools, Forecasting, and Custom ...

Splunk Developer Day was packed with product and platform updates for developers building in the AI ...