About johnrbhancock

johnrbhancock · ‎03-30-2022

I have been brainstorming the same issue. The issue is when the alert is closed then reopened it wont recongnise the same event id as the id seems to change, so if it flaps youll get alert storms. My solution is to use the monitoringobjectid and the name together. The monitoringobjectid is unique to each object but can have multiple different alerts raised against it. So using the name you ensure you only get unique events for that object. This will help with Maintenance Mode and alert storms. Even with disk alerts that seem to continue raising events at certain intervals of disk usage have different ids.

johnrbhancock · ‎04-07-2021

I have two queries. I have enabled the installed software script in splunk so I can determine where software is not installed on a windows server. How do I run a query to return all hosts that do not have specific software installed. The not function seems to only return items in a table. for example I have operations manager installed on serverx but not serverb how do I query all the servers to return server b. The second query I have is: I have pulled in two csv data sources. The first list is our CMDB server list (call it A) and the second list is an extract of servers that have agents installed (call it B). I would like to compare the two lists and return the hosts that are in list A but not in list B. The two liosts are in the same index and have the same field name (Name) for servername.

johnrbhancock · ‎05-14-2020

According to their documentation it should be available but the option is not in the app https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/ConfigureServiceNowtointegratewithSplunkEnterprise

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎05-14-2020

Online Status	Offline
Date Last Visited	‎04-01-2022 12:26 AM

returning values that dont exist

Re: scom: how to remove resolved events that are m...

returning values that dont exist

Re: OAUTH2 authentication in splunk service now