Why have Indexes stopped logging query/alert?

Sion2233 — Mon, 26 Sep 2022 15:39:03 GMT

Hi - I am trying to run the below query to help create an alert that will show when we haven't had an alert for a particular index after 15 minutes. I need to make it so it only includes specific indexes rather than all the indexes within Splunk but can't seem to get it right. Any help on how to fix it or letting me know if there is a better way to do this would be massively appreciated!

| tstats latest(_time) as latest where index=* earliest=-24hr by index | eval recent = if(latest > relative_time(now(),"-15m"),1,0), realLatest = strftime(latest,"%c") | rename realLatest as "Last Log" | where recent=0

Re: Indexes have stopped logging query/alert

isoutamo — Mon, 26 Sep 2022 11:28:28 GMT

You have two options:

Use some apps like TrackMe https://splunkbase.splunk.com/app/4621/ or Meta Woot https://splunkbase.splunk.com/app/2949/ which can do this and lot more
Use your own SPL like @gcusello has instructed on https://community.splunk.com/t5/Alerting/How-to-trigger-an-alert-if-status-event-is-not-indexed-for-5/m-p/368292 (and couple of other answers 😉

r. Ismo

topic Re: Indexes have stopped logging query/alert in Getting Data In

Why have Indexes stopped logging query/alert?

Re: Indexes have stopped logging query/alert