Splunk Search

Send Alert if # does not = 4

taylormade2169
Engager

What i am trying to do is send an alert if Alive_Iwalls does not equal 4. This will tell me if all of the firewalls are up and running. Any help would be greatly appreachiated.

sourcetype=SidewinderFirewall Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net | stats count by hostname | sort by count | stats count AS Alive_Iwalls | eval status = if(Alive_Iwalls == 4, "OK", "Error") | sendemail to="michael@SPL.com" if(status== error) 
Tags (3)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

What you need to do is pull part of your search into the alert condition of your alert. Use a search more like:

sourcetype=SidewinderFirewall 
Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net 
| stats count by hostname 

Then, when defining the scheduled search + alert, set an alert condition on "number of events" -> "does not equal" -> "4"

alt text

Then set the alert action to be the email, or any other action you need.

See docs at http://docs.splunk.com/Documentation/Splunk/5.0.2/Alert/Definescheduledalerts

View solution in original post

0 Karma

dwaddle
SplunkTrust
SplunkTrust

What you need to do is pull part of your search into the alert condition of your alert. Use a search more like:

sourcetype=SidewinderFirewall 
Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net 
| stats count by hostname 

Then, when defining the scheduled search + alert, set an alert condition on "number of events" -> "does not equal" -> "4"

alt text

Then set the alert action to be the email, or any other action you need.

See docs at http://docs.splunk.com/Documentation/Splunk/5.0.2/Alert/Definescheduledalerts

View solution in original post

0 Karma

linu1988
Champion

sourcetype=SidewinderFirewall Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net | stats count by hostname | sort by count | stats count AS Alive_Iwalls |Where Alive_Iwalls != 4

No conditions required anymore

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.