About danbutterman

danbutterman · ‎02-01-2018

Will do! Thank you, somesoni2!

danbutterman · ‎01-30-2018

Hello Splunk community, I have an alert setup that will trigger when a website status does not equal 200: index=perfmon host="nameofsearchhead" sourcetype=httpstatus | where status!=200 | lookup Prod-Websites.csv url AS url OUTPUTNEW server | table _time,url,status The results in the statistics tab show up as three columns: time, url, status code. The alert currently triggers whenever I receive more than 4 results (which could be 5 different urls, that had a single non-200 event each). I would like for the alert to trigger whenever I receive more than 4 results (non-200 events) for a single url, instead.

danbutterman · ‎01-02-2018

One step closer. I swapped out the field "EventCode" with "host" and now I'm seeing transactions. | transaction host startswith=5014 endswith=5004 maxspan=5m Next step would be to change this so that a transaction is created only when a "5004" or "1206" is not found (within 5 minutes of the error event, e.g., 5014 or 5008).

danbutterman · ‎01-02-2018

Woodcock, This is the search I perform to find 5014 and 5004 events (for example). index=wineventlogs sourcetype="WinEventLog:DFS Replication" host=DC01 OR DC02 OR DC03 EventCode=1202 OR 5002 OR 5008 OR 5012 OR 5014 OR 5004 OR 1206 | rex "Message=(? .*)" | table _time,Message,ComputerName,EventCode,Error The first two events that result are as shows below: 1/1/18 11:00:57.000 PM 01/01/2018 11:00:57 PM LogName=DFS Replication SourceName=DFSR EventCode=5004 EventType=4 1/1/18 11:00:51.000 PM 01/01/2018 11:00:51 PM LogName=DFS Replication SourceName=DFSR EventCode=5014 EventType=3 When I add in the transaction command (as follows), no results are returned: index=wineventlogs sourcetype="WinEventLog:DFS Replication" host=DC01 OR DC02 OR DC03 EventCode=1202 OR 5002 OR 5008 OR 5012 OR 5014 OR 5004 OR 1206 | rex "Message=(? .*)" | transaction EventCode startswith=5014 endswith=5004 maxspan=5m The way I imagine the transaction command is supposed to work using the example above is it finds my 5014 event at 11:00:51 PM (which marks the beginning of a new transaction, specifically where a replication error occurred), and finds the 5004 event at 11:00:57 PM (which marks the end of the transaction); however, nothing is returned. I seem to have taken a wrong turn.

danbutterman · ‎01-01-2018

I will give these a try tomorrow when I’m back in office and send an update.

danbutterman · ‎12-29-2017

Happy New Year, I'm working on an alert for certain event codes regarding DFS Replication. index=wineventlogs sourcetype="WinEventLog:DFS Replication" host=host1 OR host2 OR host3 EventCode=1202 OR 5002 OR 5008 OR 5012 OR 5014 earliest=-5m | rex "Message=(?<Message>.*)" | table _time,Message,ComputerName,EventCode,Error I would like to return a result if any of the following EventCodes are found in an event from five minutes ago (EventCode 1202 OR 5002 OR 5008 OR 5012 OR 5014), unless followed by an event with either EventCode 5004 or 1206 (which represent a recovery) within five minutes of the error event code. I'm eyeballing the case and validate functions, but I'm having some difficulty putting the picture together. Thank you for any assistance.

danbutterman · ‎12-12-2017

Exactly what I was looking for. Love this community.

danbutterman · ‎12-08-2017

This is by far the most easy-to-digest example of using and understanding the lookup command that I've found. Thank you for taking the time to lay this out. I owe you a beer or a coffee, sir.

danbutterman · ‎10-17-2017

Thank you for your response. I will give this a shot.

danbutterman · ‎10-13-2017

Hello Splunk community, My team is tasked with creating alerts for standard server monitoring metrics (CPU, memory, etc.) and separating each alert by a list of prod hosts and non-prod hosts. In other words, a high CPU alert for prod hosts to trigger anytime 24/7, and a high CPU alert for non-prod hosts to only trigger between 7AM and 7PM. Here is an example of how we're attempting to use lookup tables to narrow the alert to non-prod hosts for the 7AM to 7PM time window: index=perfmon [| inputlookup ServerNonProd-NoSQL.csv | rename ServerHost as host ] sourcetype="Perfmon:CPU Load" counter="% Processor Time" earliest=-5m latest=now | stats avg(Value) as metric by host | where metric >= 80 | eval metric= round(metric, 2) | table host,metric My question: Is this the most effective way to accomplish this task (through separate lookup tables), or is there a more efficient or advisable way of accomplishing this task? Thank you for any pointers!

Posts	10
Solutions	0
Karma Given	9
Karma Received	1
Member Since	‎10-13-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Alert trigger conditions

Alert on specific EventCode values unless followed...

Using lookup tables to create separate alerts for ...

Re: Alert trigger conditions

Alert trigger conditions

Re: Alert on specific EventCode values unless foll...

Re: Alert on specific EventCode values unless foll...

Re: Alert on specific EventCode values unless foll...

Alert on specific EventCode values unless followed...

Re: Dedup within a MV field

Re: Understanding the LOOKUP command

Re: Using lookup tables to create separate alerts ...

Using lookup tables to create separate alerts for ...