Splunk Search

Need Solution to Edit Lookup Files via Web Form

mjshoaf
New Member

We are creating a solution to monitor servers that are behind a network load balancer (NLB). The NLB sends health probes to the servers every five seconds. When a server fails to respond to the probe, the NLB generates a syslog message. It's fairly straightforward to configure an alert in Splunk that will send an email to the server team when these "health probe failed" messages are received; however, we need to account for routine server maintenance....a way to put things in "maintenance mode" so to speak so that alerts aren't generated.

I'm open to ideas on this. Anyone done this sort of thing before?

We could create a lookup table file that gets populated with servers that are down for maintenance, but we would need an easy way to modify this. Ideally, a user-friendly way for the server operators to do this themselves. I'm thinking of something like a web form where they can enter a server name or address, click submit, and have it dynamically added to the lookup table file. Of course, they would need to be able to remove it from the file as well when their maintenance is over to re-enable alerting for the server.

Any help would be greatly appreciated!

0 Karma

laserval
Communicator

There's this app:
Lookup File Editor App for Splunk Enterprise https://splunkbase.splunk.com/app/1724/

I haven't used it personally, though.

There's also an example app in the Web Framework documentation that modifies KVStore lookups.

Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...