Alerting

How to create an "OK" alert - after an alert has been issued?

JYTTEJ
Communicator

I have created this SPLUNK alert, which is logged as below:

Oct  4 19:03:46 psdkxs01 alert-splunk: MID=SxxI002E;DAT="xxxxxxxx timeout"

The alert is triggered when x number of MID=CxxI002W has been issued within the last 10 minutes.

Now I want to create an 'OK' alert on following conditions:

If MID=CxxI002W has not been issued for the last 10 minutes - AND MID=SxxI002E has been issued within the last 20 minutes - the OK alert has to be issued.

The logs for MID=CxxI002W looks like this:

Oct  4 19:06:01 psdkxp05 MID=CxxI002W;;STM=2011-10-04 19:06:01,475

How do I accomplish this?

Tags (1)

Damien_Dallimor
Ultra Champion

Maybe try something like (substitute in your own sourcetype) :

sourcetype=foo earliest=-10m@m MID=CxxI002W |  stats count as a | join  [search sourcetype=foo earliest=-20m@m MID=SxxI002E | stats count as b ] 

Then set the Alert condition to "if custom condition is met"

And set the "Custom condition search" to be :

search a = 0 AND b > 0

sbsbb
Builder

Thats a nice workaround, but in that case we have to configure 2 Search for each thing beeing monitored...

Splunk need some kind of ok condition to fire an "all ok" alert, and remove the entry in "alerts" this is missing

Damien_Dallimor
Ultra Champion

cool...don't forget to "accept" the answer...helps out splunkbase.

0 Karma

JYTTEJ
Communicator

GREAT - thank you! I did try something similar with the earliest=-10m and earliest=-20 minutes - but got stuck with an error message. You have solved my problem.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...