Splunk Search

How to trigger savedsearch on state change and match fields?

andrei1bc
Communicator

Hello,

I have the following events:

host1,message,service1,status
host2,message,service1,status
host1,message,service2,status
...

Fields extracted as

host[x] -> C_Host
message -> C_Message
service[x] -> C_service
status -> C_status

alert_actions.conf

[update]
payload_format = json
param.instance = 
param.message = 
label = UpdateC
param.end_point_id = 
icon_path = alert_udapte_cam.png
is_custom = 1
description = 
param.status = 

savedsearches.conf

[Update]
action.update = 1
action.update.param.instance = $result.C_Service$
action.update.param.message = $result.C_Message$
action.update.param.end_point_id = $result.C_Host$
action.update.param.status = $result.C_Status$

alert.digest_mode = 0
alert.suppress = 1
alert.suppress.period = 15m
alert.suppress.fields = $result.C_Service$
alert.track = true

counttype = number of events
cron_schedule = */1 * * * *
disabled = 1
dispatch.earliest_time = -1m
dispatch.latest_time = now
enableSched = 1
quantity = 0
relation = greater than
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = index=c_alerting sourcetype=c_index_update earliest=-1m

The need is to trigger the alert when the status changes and than silence for 15 min, by matching the service to it's host and status.

Please assist with the conditioning above, as I am sure that does not look right 🙂

Thank you in advance.

0 Karma

adonio
Ultra Champion

hello there,
i would suggest to try and capture the condition in search and alert on "true" statement. in other words, create a search that captured an event you would like to alert on its existence.
as i am not sure what you mean by "silence for 15 min", can you provide a sample data so we can assist with a search?

0 Karma

andrei1bc
Communicator

Example events:
host1,message,service1,status
host2,message,service1,status
host1,message,service2,status

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...