Should get an alert email when website come back up again

[abeearyan]

Hi Splunkers,

I am monitoring my websites using Splunk website monitoring, I have configured an alert which sends me email alert whenever my website goes down or takes time to response. Now I want that whenever my website came back UP again or functions normally then I should receive and alert email also to notify me that website is working fine now. Could you please shower you knowledge here and help me to setup this alert. 

TIA.

[marnall]

I assume you have logs that explicitly say whether the website is up or down. If so, you could make a new alert which compares the website status in the past X minutes until the time of the search (when the website is up) versus the website status between 2X and X minutes ago.

Let's assume a time window of 5 minutes, and you can set the schedule of the alert to be every 1-5 minutes depending on how responsive you would like the alert to be. (I recommend throttling the alert if you make it fewer than 5 minutes)

<search filters for website status=ok> earliest=-5m
| append [<search for website status = NOT OK> earliest=-10m latest=-5m]
| stats values(status) as status dc(status) as dcstatus by website
| where dcstatus > 2

This should only find websites where

10-5 minutes ago, it was down

5-0 minutes ago, it is up

[abeearyan]

Hi,
Thanks for your response, sadly I am still not able to achieve this. Can we connect over gmail or any other platform where I describe you  scenario and get it done. 

I don't understand that what needs to replace below value with:

<search filters for website status=ok>

and

<search for website status = NOT OK>

my index name is main and sourcetype is "web_ping". 

[isoutamo]

If you want / need help, all discussions will be public here in answers.

Here is @yuanliu ’s excellent description what and how you need to describe your issue, so we can help you after that. Without basic information it’s really hard and frustrating to make guesses to solve your problem.

——8<______

Let me repeat the four commandments of asking answerable questions in this forum:

• Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search (SPL that volunteers here do not have to look at).
• Illustrate the desired output from illustrated data.
• Explain the logic between illustrated data and desired output without SPL.
• If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious.