How to trigger savedsearch on state change and match fields?

[andrei1bc]

Hello,

I have the following events:

host1,message,service1,status
host2,message,service1,status
host1,message,service2,status
...

Fields extracted as

host[x] -> C_Host
message -> C_Message
service[x] -> C_service
status -> C_status

alert_actions.conf

[update]
payload_format = json
param.instance = 
param.message = 
label = UpdateC
param.end_point_id = 
icon_path = alert_udapte_cam.png
is_custom = 1
description = 
param.status = 

savedsearches.conf

[Update]
action.update = 1
action.update.param.instance = $result.C_Service$
action.update.param.message = $result.C_Message$
action.update.param.end_point_id = $result.C_Host$
action.update.param.status = $result.C_Status$

alert.digest_mode = 0
alert.suppress = 1
alert.suppress.period = 15m
alert.suppress.fields = $result.C_Service$
alert.track = true

counttype = number of events
cron_schedule = */1 * * * *
disabled = 1
dispatch.earliest_time = -1m
dispatch.latest_time = now
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = index=c_alerting sourcetype=c_index_update earliest=-1m

The need is to trigger the alert when the status changes and than silence for 15 min, by matching the service to it's host and status.

Please assist with the conditioning above, as I am sure that does not look right 🙂

Thank you in advance.

[adonio]

hello there,
i would suggest to try and capture the condition in search and alert on "true" statement. in other words, create a search that captured an event you would like to alert on its existence.
as i am not sure what you mean by "silence for 15 min", can you provide a sample data so we can assist with a search?

[andrei1bc]

Example events:
host1,message,service1,status
host2,message,service1,status
host1,message,service2,status