Splunk ITSI

Windows Server Critical Service Status Change- Can this be implemented as a normal alert?

santosh_sshanbh
Path Finder

I want to monitor the critical services running status on a Windows server. Need to trigger ticket if any of the critical service is stopped for x number of minutes. Can this be implemented as normal alert or needs episode to be created? Normal alert have drawback of triggering again and again in case of service is down for longer time.

Labels (1)
0 Karma

skramp
SplunkTrust
SplunkTrust

I'd do this with an episode. As you mentioned, you can do this without ITSI a a normal alert but the better way would be doing this out of ITSI. You can close the episode automatically if the service is up again or on the other hand it will can be configured to send a message only once until episode breaks. But regarding the usage of itsi, normally you are monitoring a service availability and for this availability you need running Windows-Services. Won't it be better to cover it like this than just looking for "running-services-on-a-windows-host"?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us.  The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...