thanks for assistance - so heres my search - nothing is being populated in the csv file although it is created the search on its own gives me the following event: index=windows host="HOST" sourcetype="WinHostMon" Name=MYSQL57 State="stopped" Type=Service Name="MySQL57" DisplayName= Description= Path=""C:\Program Files\MySQL\MySQL Server 5.7\bin\mysqld.exe" --defaults-file="C:\ProgramData\MySQL\MySQL Server 5.7\my.ini" MySQL57" ServiceType="Own Process" StartMode="Auto" Started=false State="Stopped" Status="OK" ProcessId=0 With your search (changed status to State) index=windows host="HOST" sourcetype="WinHostMon" Name=MYSQL57 State="stopped" | dedup host state | rename _time AS Time | appendpipe [|inputcsv WindowsStatus | eval state="stopped"] | stats min(Time) AS Time values(status) AS state BY host | search NOT state="running" | table Time host | outputcsv WindowsStatus ... View more

Hi, i still can't see how that helps for example if i set a throttle for 30 mins then i effectively have a 30 min gap of not knowing what state my service is in ? I'm looking for something like this .. maybe 2 searches joined together ? mins State Alert 5 running No 10 stopped yes 15 stopped no 20 stopped no 25 stopped no 30 stopped no 35 running no (or maybe a changed state - clear Alarm) 40 stopped yes ... View more

but that just hides the alert for a period of time ? ... View more

played around with throttle and that doesn't really give me what i want. If i say throttle for 30 mins then it will send another alert after 30 mins .. in in that 30 mins the service could have been restarted - and fell over again - and we won't know about it for another 30 mins. cheers. I have been trawling answers for sometime looking for something similar - and the closest i have found is something like look for a status and write it to a lookup file - then create another search and check that lookup file and alert if status is X but i'm not 100% on how to go about that either at the mo. ... View more

Thanks for your input - can you explain further why this only runs once ? When the search runs again in 5 mins .. why won't the alert be triggered again ? Actually - yes i tried it and it has alerted again - the alert sends a webhook to another app - so currently it has sent a duplicate alert which has created a separate incident - which is what was occurring before ... View more

nice thanks all. ... View more

Thanks - i found the same use case prior - but it was quite an old article and wasn't exactly what i was looking for although i have gleaned some ideas I have access to a cisco aeronet 1600 which is not controller based but standalone - would the cisco TA give me some useful sourcetypes for use here ?What about the Cisco App ? i didn't see my device listed as supported. Supported Cisco Devices: * Cisco Catalyst series switches (2960, 3650, 3750, 4500, 6500, 6800, 7600 etc.) * Cisco ASR - Aggregation Services Routers (900, 1000, 5000, 9000 etc.) * Cisco ISR - Integrated Services Routers (800, 1900, 2900, 3900, 4451 etc.) * Cisco Nexus Data Center switches (1000V, 2000, 3000, 4000, 5000, 6000, 7000, 9000 etc.) * Cisco Carrier Routing System * Other Cisco IOS based devices (Metro Ethernet, Industrial Ethernet, Blade Switches, Connected Grid etc.) * Cisco WLC - WLAN Controller ... View more

thanks for your help ... View more

Thanks Lucas, For Clarification : If i don't need 2 x SH at this stage - and therefore no deployer. If a deployer was required then i'd have to install splunk in a new location if i was using the same box eg /opt/splunk_shc and i would need to change the ports ? So the LM, CM and deployment server can all co-exist on the one box with no port adjustments - they can all use the mgmt port 8089 ? ... View more

Cheers Eric .. yep aware of the prod requirements - thanks for the SHC tip. ... View more

i see your point - however, further entries: 12/02/2015 12:00:00 AM, Execute Time: 1415 12/02/2015 12:00:00 AM, Execute Time: 1500 12/02/2015 12:00:00 AM, Execute Time: 1515 12/02/2015 12:00:00 AM, Execute Time: 1315 ... View more

it is definitely 24h - thanks i'll try first thing in the morn ... View more

hi thanks - i'm trying to do this in a props.conf file - not in a search ... View more

OK if you use that method then the file is placed : $SPLUNK_HOME/etc/apps/search/local/inputs.conf ... View more

Hi I have some other questions with regards to inputs. I have tried a few test URLs - now if i add a URL using settings > data inputs > website availability check - the config is written to the ../local/inputs.conf file. But if i try and use the new "create inputs" tab on the dashboard\homepage then where does it write this config as nothing is written to the ../local/inputs.conf using this method although the URL is added to the list and polled. Also i cannot see how to remove a URL entered using this method ? Thanks. ... View more

Yep apart from that - it all seems to be working fine, thx ... View more

there seems to be a bug in our env (6.2.3) where none of the DMC data was being populated properly. The workaround was to go into the DMC on the master node > select setup > and apply which seemed to restore all the dashboards. ... View more