Splunk Search

How to compare 2 searches and alert on the differences?

mbowman6241
New Member

I am trying to alert if one of my servers is left out of load balance for a specific amount of time.

My current search is:

index=netcool $server-ip$ Node | rex field=_raw "Node\s\/Common\/(?<host>.*)\s+address\s(?<ipaddress>[\d\.]+)\ssession status\s(?<status>.*)\." | where status!=" monitor status unchecked" AND status!=" monitor status forced down" | table _time, host, status | sort  -_time | dedup snehost

This gives me a table of all my servers and a status of either "enabled" or "forced disabled" which is perfect. I want to be able to run this search every fifteen minutes and have it generate an alert if the server status is "forced disabled" for an extended period of time.

My original thoughts are, this search runs every 15min and the latest search compares the previous search. Is this possible?

0 Karma

MuS
Legend

Hi mbowman6241,

run this search every 15min as planed, but have the results written to a lookup file by using the outputlookup command in the search http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Outputlookup
Create a second search or Alert which facilitates the lookup using inputlookup http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Inputlookup to get the last status and compare it with the current, if they differ create an alert.

Hope this makes sense ...

cheers, MuS

0 Karma

mbowman6241
New Member

That makes complete sense. Thank you. Let me see if I can get this to work now.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...