Splunk Search

Create a search who return status ok, or 200

Redjon_27
New Member

Hello,

I'm working in Splunk enterprise with the search queries.

I use a Website monitoring app for my website.

I run a search to send my alerts where the website is not responding and is working fine.

How to run a query to send my alerts for that website it was down before 5 minutes now is ok?

I would greatly appreciate your help.

Br.

-------------------------------------------------------------------------------------------------------------------------------

My search who look for errors: 

 

0 Karma

Redjon_27
New Member

sourcetype=web_ping title="Billy-Bridge" `website_monitoring_search_index` | `set_response_code` | `set_status` | stats sparkline(avg(total_time)) as avg_response_time max(total_time) as max_response_time latest(response_code) as response_code latest(_time) as last_checked latest(title) as title latest(url) as url latest(total_time) as range min(total_time) as min latest(status) as status by source | search
| eval average=round(avg_response_time, 0)." ms"
| eval maximum=round(max_response_time, 0)." ms"
| eval range=round(min, 0)." - ".round(min+range, 0)." ms"
| eval response=response_code
| table title url response last_checked status
| `timesince(last_checked,last_checked)`
| sort -response_time | search response="Connection timed out" OR response=404 OR response=502 OR response=504

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...