Hi community I know that it works perfectly on ON PREM env. but for Cloud has being a challenge to find a sustainable solution We are looking for a way to project images on dashboards built in a Splunk Cloud env Did anyone have this challenge? How it was? ... View more

Ok, so here is my question These 3 lines denote possible values for scheduled downtime MSG WHEN DOWNTIME START STARTED SERVICE DOWNTIME ALERT: afakeci;Service Schedule;STARTED; Service has entered a period of scheduled downtime CANCELLED SERVICE DOWNTIME ALERT: afakeci;Service Schedule;CANCELLED; Scheduled downtime for service has been cancelled. STOPPED SERVICE DOWNTIME ALERT: afakeci;Service Schedule;STOPPED; Service has exited from a period of scheduled downtime Then i have my SPL looking for something index="test" earliest=-1h AND ( ( eventname="SERVICE NOTIFICATION" AND status_code=CRITICAL ) OR ( eventname="PASSIVE SERVICE CHECK" AND state=2 ) AND ( service_name="CPU utilization" OR service_name="Memory and pagefile*" OR service_name="Filesystem*" OR service_name="Service*" OR service_name="File*") ) OR ( eventname="HOST NOTIFICATION" AND status_code="DOWN" ) | eval service_name=if( eventname=="HOST NOTIFICATION" , "ICMP request (PING)" , service_name ) | eval status_code=if( eventname=="PASSIVE SERVICE CHECK" , "CRITICAL" , status_code ) | eval nagios_timestamp=timestamp | convert ctime(nagios_timestamp) | eval alert_seed=status_code.".".host_name.".".service_name What i want to do is: IF my SPL found a event then Execute second query to find during the last hour at least one ocurrence of downtime with status != of STARTED: index="test" host_name=afakeci earliest=-1 eventname="SERVICE DOWNTIME ALERT" ( "CANCELLED" OR "STOPPED" ) | stats count In this case means that maintanence mode finished and the alert is real then i can raise alert ELSE Finish the execution I was checking for cmds "transaction", "search" ... and did not found a solution yet =( ... View more