correction : no need of alerts during 23:50 to 00:15 ... View more

Updating my SPL to below index=XXX source="XXX" | eval status=spath(_raw,members{}.state) | eval rs_status=case(status == "Primary", "OK", status =="ARBITER", "OK", status == "SECONDARY", "OK", status == "STARTUP", "KO", status == "RECOVERING", "KO" status == "STARTUP2", "KO", status == "UNKNOWN", "KO", status == "DOWN", "KO", status == "ROLLBACK", "KO", status == "REMOVED", "KO") | sort - _time | where rs_status="KO" below is the JSON format { "set" : "replset", "date" : ISODate("2020-03-05T05:24:45.567Z"), "myState" : 1, "term" : NumberLong(3), "syncSourceHost" : "", "syncSourceId" : -1, "heartbeatIntervalMillis" : NumberLong(2000), "majorityVoteCount" : 2, "writeMajorityCount" : 2, "votingMembersCount" : 3, // Available starting in v4.4 "writableVotingMembersCount" : 3, // Available starting in v4.4 "optimes" : { "lastCommittedOpTime" : { "ts" : Timestamp(1583385878, 1), "t" : NumberLong(3) }, "lastCommittedWallTime" : ISODate("2020-03-05T05:24:38.122Z"), "readConcernMajorityOpTime" : { "ts" : Timestamp(1583385878, 1), "t" : NumberLong(3) }, "readConcernMajorityWallTime" : ISODate("2020-03-05T05:24:38.122Z"), "appliedOpTime" : { "ts" : Timestamp(1583385878, 1), "t" : NumberLong(3) }, "durableOpTime" : { "ts" : Timestamp(1583385878, 1), "t" : NumberLong(3) }, "lastAppliedWallTime" : ISODate("2020-03-05T05:24:38.122Z"), "lastDurableWallTime" : ISODate("2020-03-05T05:24:38.122Z") }, "lastStableRecoveryTimestamp" : Timestamp(1583385868, 2), "electionCandidateMetrics" : { "lastElectionReason" : "stepUpRequestSkipDryRun", "lastElectionDate" : ISODate("2020-03-05T05:24:28.061Z"), "electionTerm" : NumberLong(3), "lastCommittedOpTimeAtElection" : { "ts" : Timestamp(1583385864, 1), "t" : NumberLong(2) }, "lastSeenOpTimeAtElection" : { "ts" : Timestamp(1583385864, 1), "t" : NumberLong(2) }, "numVotesNeeded" : 2, "priorityAtElection" : 1, "electionTimeoutMillis" : NumberLong(10000), "priorPrimaryMemberId" : 1, "numCatchUpOps" : NumberLong(0), "newTermStartDate" : ISODate("2020-03-05T05:24:28.118Z"), "wMajorityWriteAvailabilityDate" : ISODate("2020-03-05T05:24:28.228Z") }, "electionParticipantMetrics" : { "votedForCandidate" : true, "electionTerm" : NumberLong(2), "lastVoteDate" : ISODate("2020-03-05T05:22:33.306Z"), "electionCandidateMemberId" : 1, "voteReason" : "", "lastAppliedOpTimeAtElection" : { "ts" : Timestamp(1583385748, 1), "t" : NumberLong(1) }, "maxAppliedOpTimeInSet" : { "ts" : Timestamp(1583385748, 1), "t" : NumberLong(1) }, "priorityAtElection" : 1 }, "members" : [ { "_id" : 0, "name" : "m1.example.net:27017", "health" : 1, "state" : 1, "stateStr" : "PRIMARY", "uptime" : 269, "optime" : { "ts" : Timestamp(1583385878, 1), "t" : NumberLong(3) }, "optimeDate" : ISODate("2020-03-05T05:24:38Z"), "lastAppliedWallTime": ISODate("2020-03-05T05:24:38Z"), "lastDurableWallTime": ISODate("2020-03-05T05:24:38Z"), "syncSourceHost" : "", "syncSourceId" : -1, "infoMessage" : "", "electionTime" : Timestamp(1583385868, 1), "electionDate" : ISODate("2020-03-05T05:24:28Z"), "configVersion" : 1, "configTerm" : 0, "self" : true, "lastHeartbeatMessage" : "" }, ... View more

Thank you your input, I found one workaround and here is the code. Luckily I am having timestamp field in my lookup file so I making use of that. If you have any idea to make it better please let me know | inputlookup lkp_sds_wms_trw_slislo.csv | eval start_date = strftime(relative_time(now(),"-60d@d"), "%Y-%m-%d") | eval Endtimestamp = strptime(start_date, "%Y-%m-%d") |where timestamp > Endtimestamp | outputlookup lkp_sds_wms_trw_slislo.csv   Thanks Again   Regards Amit ... View more

Thanks for responding, do you have any examples using summary index ... View more

Hello Sir, I have put the details in this post and why this splunk query is not working for me. I am trying to see if for this case alert generation is possible or no ? If its possible please let me know how can I do it. Regards Amit     ... View more

Thank you Sir. I just wanted to check if the code which I have put in is correct or am I making any mistakes with my logic ? Regards Amit     ... View more

Hello Sir,   Thanks for your response but I am not getting your question, the script  I put is my alert script and its giving me updated timestamp for that file, and i am just checking if its updated in certain time period or no? But if you think I am missing anything on the script please let me know.   Regards Amit ... View more

Thank you, I have another question, do you any references or samples to create ticket in servicenow using ITSI plugin, I also need to create if thresholds are breaching ... View more