Splunk Search

How to trigger savedsearch on state change and match fields?

andrei1bc
Communicator

Hello,

I have the following events:

host1,message,service1,status
host2,message,service1,status
host1,message,service2,status
...

Fields extracted as

host[x] -> C_Host
message -> C_Message
service[x] -> C_service
status -> C_status

alert_actions.conf

[update]
payload_format = json
param.instance = 
param.message = 
label = UpdateC
param.end_point_id = 
icon_path = alert_udapte_cam.png
is_custom = 1
description = 
param.status = 

savedsearches.conf

[Update]
action.update = 1
action.update.param.instance = $result.C_Service$
action.update.param.message = $result.C_Message$
action.update.param.end_point_id = $result.C_Host$
action.update.param.status = $result.C_Status$

alert.digest_mode = 0
alert.suppress = 1
alert.suppress.period = 15m
alert.suppress.fields = $result.C_Service$
alert.track = true

counttype = number of events
cron_schedule = */1 * * * *
disabled = 1
dispatch.earliest_time = -1m
dispatch.latest_time = now
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = index=c_alerting sourcetype=c_index_update earliest=-1m

The need is to trigger the alert when the status changes and than silence for 15 min, by matching the service to it's host and status.

Please assist with the conditioning above, as I am sure that does not look right 🙂

Thank you in advance.

0 Karma

adonio
Ultra Champion

hello there,
i would suggest to try and capture the condition in search and alert on "true" statement. in other words, create a search that captured an event you would like to alert on its existence.
as i am not sure what you mean by "silence for 15 min", can you provide a sample data so we can assist with a search?

0 Karma

andrei1bc
Communicator

Example events:
host1,message,service1,status
host2,message,service1,status
host1,message,service2,status

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...