I have the following events:
host1,message,service1,status host2,message,service1,status host1,message,service2,status ...
Fields extracted as
host[x] -> C_Host message -> C_Message service[x] -> C_service status -> C_status
[update] payload_format = json param.instance = param.message = label = UpdateC param.end_point_id = icon_path = alert_udapte_cam.png is_custom = 1 description = param.status =
[Update] action.update = 1 action.update.param.instance = $result.C_Service$ action.update.param.message = $result.C_Message$ action.update.param.end_point_id = $result.C_Host$ action.update.param.status = $result.C_Status$ alert.digest_mode = 0 alert.suppress = 1 alert.suppress.period = 15m alert.suppress.fields = $result.C_Service$ alert.track = true counttype = number of events cron_schedule = */1 * * * * disabled = 1 dispatch.earliest_time = -1m dispatch.latest_time = now enableSched = 1 quantity = 0 relation = greater than request.ui_dispatch_app = search request.ui_dispatch_view = search search = index=c_alerting sourcetype=c_index_update earliest=-1m
The need is to trigger the alert when the status changes and than silence for 15 min, by matching the service to it's host and status.
Please assist with the conditioning above, as I am sure that does not look right 🙂
Thank you in advance.
i would suggest to try and capture the condition in search and alert on "true" statement. in other words, create a search that captured an event you would like to alert on its existence.
as i am not sure what you mean by "silence for 15 min", can you provide a sample data so we can assist with a search?