I am fairly new to the Splunk platform/ community; I am in learning mode 😞 and I hope to get some help here. How do I set up/configure an alert on a set of Windows Servers to notify me when a particular set of services stops? For example, I have three services that start with the naming of TDB, how can I configure Splunk to alert if any of those services stop on a particular server name. Thanks much.
Hi @Razzi,
you should define the fields that you can use to identify the fields to use:
Then you should create a lookup (called e.g. perimeter.csv) containing the hosts to monitor (supponing that the three services to monitor must be active in all the servers).
Then you should run a search like the following:
index=<your_index> process IN (TBD1, TBD2, TBD3)
| stats
dc(process) AS process_count
values(process) AS process
count
BY host
| append [
| inputlookup perimeter.csv
| eval count=0
| fields host count
]
| stats
dc(process) AS process_count
values(process) AS process
sum(count) AS total
BY host
| where total=0 OR process_count<3
| eval status=if(total=0, "missed host", "missed process")
| table host status process
| rename process AS "present processes"
Ciao.
Giuseppe