Splunk Apps » Insteon

[Leak Sensor Failed to Check In]
action.email = 1
action.email.include.results_link = 0
action.email.include.view_link = 0
action.email.inline = 1
action.email.message.alert = At least one leak sensor failed to check-in within the last 24 hours.
action.email.reportServerEnabled = 0
action.email.sendresults = 1
action.email.subject = Leak sensor failed to check in
alert.expires = 7d
alert.severity = 2
alert.suppress = 1
alert.suppress.period = 12h
alert.track = 1
auto_summarize.dispatch.earliest_time = -1d@h
counttype = number of events
cron_schedule = 0 * * * *
description = Detects when a leak sensor failed to check-in
dispatch.earliest_time = -7d
dispatch.latest_time = now
enableSched = 1
quantity = 0
relation = greater than
search = sourcetype=insteon_plm           subcategory=8 category=10 modem_command_code=50 all_link=1 `get_command_info`           | sort -_time           | stats first(command) as command first(_time) as last_seen first(subcategory) as subcategory first(category) as category by from           | eval address=from           | eval status=if(like(command, "%wet%"),1,0)           | inputlookup insteon_devices append=t           | search subcategory=8 category=10 address="*"           | stats first(status) as status first(last_seen) as last_seen_int last(name) as name last(room) as room by address           | fillnull status value="-1"           | `timesince(last_seen_int,last_seen)`           | where (now()-last_seen_int > 90000)