Alerting

Phone Home Error Not Alerting Properly

drizzo
Path Finder

So, I have my Phone Home Error search; when I type it into the Search Bar, it pulls up all hosts not connected. However, when I try to set it up as an alert, it will only send out an Alert for the first one that disconnected. I have it Throttled, but for suppressing those with the same host.

Also, over time, it will stop pulling computers that have been disconnected from the server for more than 7 days. The only way to get them is to do an All Time search (using the search string from the alert).

I'm a little lost, and would be thankful for any guidance. Thanks.

My Search:

| metadata type=hosts index=_internal | eval age=now()-recentTime | where age > 300 | eval "Time Indexed"=strftime(_time, "%Y/%d/%m %H:%M") | eval "Computer Host"=host | eval "Time Last Connected"=tostring(age, "duration") | eval "Date Last Connected"=strftime=)recentTime, ""%+") | table "Computer Host", "Time Last Connected", "Date Last Connected"

My Alert Settings:

alt text

0 Karma
1 Solution

woodcock
Esteemed Legend

Generally, when using the metadata command for something like this, you should be using All time for your search span. The way that metadata works is to go to buckets written within your span and give you a summary of that If you limit your search's time to a window that does not include any buckets, then you will get no summary, which is NOT what you need. So set it to All time (or a REALLY long time) and do not at all be concerned that you are doing a deep/expensive search, because for this particular command, you definitely are not because like tstats, it is operating on the metadata.

View solution in original post

woodcock
Esteemed Legend

Generally, when using the metadata command for something like this, you should be using All time for your search span. The way that metadata works is to go to buckets written within your span and give you a summary of that If you limit your search's time to a window that does not include any buckets, then you will get no summary, which is NOT what you need. So set it to All time (or a REALLY long time) and do not at all be concerned that you are doing a deep/expensive search, because for this particular command, you definitely are not because like tstats, it is operating on the metadata.

drizzo
Path Finder

I suppose I misunderstood what metadata is used for. Thanks.

0 Karma

sbbadri
Motivator

Try to change query like below,

| inputlookup dmc_forwarder_assets
| search status="missing" AND os="Windows"
| fields hostname os arch forwarder_type version last_connected status
| rename hostname as Instance
| eval now=now() | eval Duration_Not_Connected=now-last_connected | where Duration_Not_Connected<=2592000 | fields - last_connected now | sort Duration_Not_Connected | eval Duration_Not_Connected_Days = round(Duration_Not_Connected/86400,0)

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...