Splunk Search

Need Solution to Edit Lookup Files via Web Form

New Member

We are creating a solution to monitor servers that are behind a network load balancer (NLB). The NLB sends health probes to the servers every five seconds. When a server fails to respond to the probe, the NLB generates a syslog message. It's fairly straightforward to configure an alert in Splunk that will send an email to the server team when these "health probe failed" messages are received; however, we need to account for routine server maintenance....a way to put things in "maintenance mode" so to speak so that alerts aren't generated.

I'm open to ideas on this. Anyone done this sort of thing before?

We could create a lookup table file that gets populated with servers that are down for maintenance, but we would need an easy way to modify this. Ideally, a user-friendly way for the server operators to do this themselves. I'm thinking of something like a web form where they can enter a server name or address, click submit, and have it dynamically added to the lookup table file. Of course, they would need to be able to remove it from the file as well when their maintenance is over to re-enable alerting for the server.

Any help would be greatly appreciated!

0 Karma


There's this app:
Lookup File Editor App for Splunk Enterprise https://splunkbase.splunk.com/app/1724/

I haven't used it personally, though.

There's also an example app in the Web Framework documentation that modifies KVStore lookups.

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...