These are the criterias that we have –

• Data comes in every 15 mins
• If the database status is down for a particular host for 45 mins, (that is 3 counts as data is coming every 15 mins) we need to trigger alert to create ticket.
• we don’t need to create tickets for those hosts for 48 hours. Even if after 48hours the issue persists, then we create a new ticket.

Splunk search to get db down in 45 mins

index=abc db.status= “0” earliest=-45m@m | stats count by host | wherr count > 3

I have worked out how to create ticket after an alert gets triggered.

I have issues in making sure that the hosts are not repeated in ticket creation.