Splunk Search

create an alert from two diffrent events

bballad
Explorer

We are looking to create an alert that will trigger if two distinct events happens. The first event is a DB health check and the second is a services check. we wnat the alert to tirgger if the DB comes back unhealthy AND the service is running. 

I cna search for either event, but combining the searches with an append or a multisearch seems to act as an or, where the evnets show up even if only one of the searches has results. We only want the alert to trigger if both searches return values.

 

Labels (1)
0 Karma

burwell
SplunkTrust
SplunkTrust

Hi. Can you show us what you have tried so far?

0 Karma

bballad
Explorer

| multisearch [search index="illuminate" sourcetype="WinHostMon" "RAVN-Insight" Running ] [search index="illuminate" sourcetype="_json_overseerstatus" host="naravncore01" | spath "databases.ravn.instances.Repl1.health" | search "databases.ravn.instances.Repl1.health"!=Healthy]

0 Karma

bballad
Explorer

OK folks, I am an idiot. 

 

I was so close too. Just needed to trigger the aler on the number of sources not the number of events. I was making things far to complex in my head

thanks for looking

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...