Splunk Search

create an alert from two diffrent events

bballad
Explorer

We are looking to create an alert that will trigger if two distinct events happens. The first event is a DB health check and the second is a services check. we wnat the alert to tirgger if the DB comes back unhealthy AND the service is running. 

I cna search for either event, but combining the searches with an append or a multisearch seems to act as an or, where the evnets show up even if only one of the searches has results. We only want the alert to trigger if both searches return values.

 

Labels (1)
0 Karma

burwell
SplunkTrust
SplunkTrust

Hi. Can you show us what you have tried so far?

0 Karma

bballad
Explorer

| multisearch [search index="illuminate" sourcetype="WinHostMon" "RAVN-Insight" Running ] [search index="illuminate" sourcetype="_json_overseerstatus" host="naravncore01" | spath "databases.ravn.instances.Repl1.health" | search "databases.ravn.instances.Repl1.health"!=Healthy]

0 Karma

bballad
Explorer

OK folks, I am an idiot. 

 

I was so close too. Just needed to trigger the aler on the number of sources not the number of events. I was making things far to complex in my head

thanks for looking

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...