Splunk Search

Create a search who return status ok, or 200

Redjon_27
New Member

Hello,

I'm working in Splunk enterprise with the search queries.

I use a Website monitoring app for my website.

I run a search to send my alerts where the website is not responding and is working fine.

How to run a query to send my alerts for that website it was down before 5 minutes now is ok?

I would greatly appreciate your help.

Br.

-------------------------------------------------------------------------------------------------------------------------------

My search who look for errors: 

 

0 Karma

Redjon_27
New Member

sourcetype=web_ping title="Billy-Bridge" `website_monitoring_search_index` | `set_response_code` | `set_status` | stats sparkline(avg(total_time)) as avg_response_time max(total_time) as max_response_time latest(response_code) as response_code latest(_time) as last_checked latest(title) as title latest(url) as url latest(total_time) as range min(total_time) as min latest(status) as status by source | search
| eval average=round(avg_response_time, 0)." ms"
| eval maximum=round(max_response_time, 0)." ms"
| eval range=round(min, 0)." - ".round(min+range, 0)." ms"
| eval response=response_code
| table title url response last_checked status
| `timesince(last_checked,last_checked)`
| sort -response_time | search response="Connection timed out" OR response=404 OR response=502 OR response=504

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...