Splunk Search

How to trigger savedsearch on state change and match fields?

andrei1bc
Communicator

Hello,

I have the following events:

host1,message,service1,status
host2,message,service1,status
host1,message,service2,status
...

Fields extracted as

host[x] -> C_Host
message -> C_Message
service[x] -> C_service
status -> C_status

alert_actions.conf

[update]
payload_format = json
param.instance = 
param.message = 
label = UpdateC
param.end_point_id = 
icon_path = alert_udapte_cam.png
is_custom = 1
description = 
param.status = 

savedsearches.conf

[Update]
action.update = 1
action.update.param.instance = $result.C_Service$
action.update.param.message = $result.C_Message$
action.update.param.end_point_id = $result.C_Host$
action.update.param.status = $result.C_Status$

alert.digest_mode = 0
alert.suppress = 1
alert.suppress.period = 15m
alert.suppress.fields = $result.C_Service$
alert.track = true

counttype = number of events
cron_schedule = */1 * * * *
disabled = 1
dispatch.earliest_time = -1m
dispatch.latest_time = now
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = index=c_alerting sourcetype=c_index_update earliest=-1m

The need is to trigger the alert when the status changes and than silence for 15 min, by matching the service to it's host and status.

Please assist with the conditioning above, as I am sure that does not look right 🙂

Thank you in advance.

0 Karma

adonio
SplunkTrust
SplunkTrust

hello there,
i would suggest to try and capture the condition in search and alert on "true" statement. in other words, create a search that captured an event you would like to alert on its existence.
as i am not sure what you mean by "silence for 15 min", can you provide a sample data so we can assist with a search?

0 Karma

andrei1bc
Communicator

Example events:
host1,message,service1,status
host2,message,service1,status
host1,message,service2,status

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!