What i am trying to do is send an alert if Alive_Iwalls does not equal 4. This will tell me if all of the firewalls are up and running. Any help would be greatly appreachiated.
sourcetype=SidewinderFirewall Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net | stats count by hostname | sort by count | stats count AS Alive_Iwalls | eval status = if(Alive_Iwalls == 4, "OK", "Error") | sendemail to="michael@SPL.com" if(status== error)
What you need to do is pull part of your search into the alert condition of your alert. Use a search more like:
sourcetype=SidewinderFirewall
Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net
| stats count by hostname
Then, when defining the scheduled search + alert, set an alert condition on "number of events" -> "does not equal" -> "4"
Then set the alert action to be the email, or any other action you need.
See docs at http://docs.splunk.com/Documentation/Splunk/5.0.2/Alert/Definescheduledalerts
What you need to do is pull part of your search into the alert condition of your alert. Use a search more like:
sourcetype=SidewinderFirewall
Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net
| stats count by hostname
Then, when defining the scheduled search + alert, set an alert condition on "number of events" -> "does not equal" -> "4"
Then set the alert action to be the email, or any other action you need.
See docs at http://docs.splunk.com/Documentation/Splunk/5.0.2/Alert/Definescheduledalerts
sourcetype=SidewinderFirewall Idsiwall1.ids.net OR idsiwall3.ids.net OR Idsiwall2.ids.net OR idsiwall4.ids.net | stats count by hostname | sort by count | stats count AS Alive_Iwalls |Where Alive_Iwalls != 4
No conditions required anymore