Splunk Search

Is it possible to create an alert only if a certain condition is not met?

santosh1
Explorer

So I want to create an alert if one of our server is not connected, but the server disconnects automatically for every 12 hours and reconnects again in a few minutes, so I only need an alert triggered if the server does not reconnect within 10minutes of it getting disconnected.

*SourceName="AppLog" Message="service status *"*

there are two logs that occur, one is service status started and service status stopped. I need the alert triggered only if the service status started log does not appear within 10min of service stopped log message

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Create a report that looks back over the previous 15 minutes for started and stopped messages, find the time of the latest message, and if the latest message is stopped and more than 10 minutes ago, keep the event. If you schedule the report to run every minute or at worst every 5 minutes, you should be able to capture when the server has not started in time

0 Karma

santosh1
Explorer

Could you possibly show it to me as an example syntax I can use. I am new the Splunk Search Syntax

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...