Alerting

How to create alert if no up alert received within 1 minutes?

Raymundo
Loves-to-Learn

I have two types of events when the interface is down and when it is up


It usually happens that the interface comes down, after 10 seconds it goes back up.

* An event arrives where it tells me that the interface is down
* Another event arrives where it tells me that the interface is up and it was down for 10 seconds.

I would like to alert if the interface does not come back up in a period of 1 minute.

I have tried several options but I have not been able to make it alert.

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Raymundo ,

I suppose that the messages are: system_down and system_up, otherwise adapt my search:

index=your_index (message="system_up" OR message="system_down")
| eval status=if(message="system_up","system_up","system_down")
| stats dc(status) AS status_count values(status) AS status
| where dc_status=1 AND status="system_up"

to run every minute.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...