Splunk Search

How to trigger alert when the index from Down to Running State?

karthi2809
Contributor

How to trigger alert when the index from Down to Running State?
My query is to find index is down.But it will trigger only once.I need to continuously when the index is to running state .

| metadata type=hosts index*_prod | eval age = now() - recentTime | eval status= case(age < 900,"Running",age > 900,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status|where Status= "DOWN"

Tags (5)
0 Karma

pkeenan87
Communicator

Have you looked at the meta woot app? https://splunkbase.splunk.com/app/2949/ This is very helpful in auditing when data sources/indexes are down. There are some panels you could use as a template to convert into an alert

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...