Requirement - alert only needs to trigger outside window even if server is down in maintenance window
| tstats count where index=cts-dcpsa-app sourcetype=app:dcpsa host_ip IN (xx.xx.xxx.xxx, xx.xx.xxx.xxx) by host
| eval current_time=_time
| eval excluded_start_time=strptime("2024-04-14 21:00:00", "%Y-%m-%d %H:%M:%S")
| eval excluded_end_time=strptime("2024-04-15 04:00:00", "%Y-%m-%d %H:%M:%S")
| eval is_maintenance_window=if(current_time >= excluded_start_time AND current_time < excluded_end_time, 1, 0)
| eval is_server_down=if((host="xx.xx.xxx.xxx" AND count == 0) OR (host="xx.xx.xxx.xxx" AND count == 0) 1, 0 )
Trigger condition- |search is_maintenance window = 0 AND is_server_down=1
Alert is not getting triggered outside maintenance window even though one of server is down. Help me what is wrong in query or another possible solution
... View more