Splunk Search

create an alert from two diffrent events

bballad
Explorer

We are looking to create an alert that will trigger if two distinct events happens. The first event is a DB health check and the second is a services check. we wnat the alert to tirgger if the DB comes back unhealthy AND the service is running. 

I cna search for either event, but combining the searches with an append or a multisearch seems to act as an or, where the evnets show up even if only one of the searches has results. We only want the alert to trigger if both searches return values.

 

Labels (1)
0 Karma

burwell
SplunkTrust
SplunkTrust

Hi. Can you show us what you have tried so far?

0 Karma

bballad
Explorer

| multisearch [search index="illuminate" sourcetype="WinHostMon" "RAVN-Insight" Running ] [search index="illuminate" sourcetype="_json_overseerstatus" host="naravncore01" | spath "databases.ravn.instances.Repl1.health" | search "databases.ravn.instances.Repl1.health"!=Healthy]

0 Karma

bballad
Explorer

OK folks, I am an idiot. 

 

I was so close too. Just needed to trigger the aler on the number of sources not the number of events. I was making things far to complex in my head

thanks for looking

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...