topic Re: Alerts when indexing stops in Alerting

Alerts when indexing stops

gba8912 — Tue, 02 Feb 2021 15:44:26 GMT

Hello,

I am a noob at Splunk. I know there are a few posts on this already but I'm not able to find a solution for my specific problem. I want to make an alert for when indexing stops. I am using the following: | tstats latest(_time) as latest where index=* by host | where latest < relative_time(now(), "-1m")

Normally, I want the "-1m" to be "-1d" but i changed it to test the alert. I can see on the search that I have a result from an ip address that is not indexing events every minute so I know the search is working. When I save it as an alert however, I get no alerts. I have tried real-time and scheduled alerts to attempts a trigger.

Does anyone know why the alert doesnt work or if there is something off with the search I am trying to use?

Thanks!

Re: Alerts when indexing stops

burwell — Wed, 03 Feb 2021 06:48:13 GMT

Hi do you want to share exactly how you are setting up the alert condition and what are you using to alert? Can you check the _internal index for errors?

Re: Alerts when indexing stops

gba8912 — Wed, 03 Feb 2021 19:55:56 GMT

Hi Burwell,

Thanks for your reply. I have searched _internal and have 1,136,041 events. I don't really see any errors but maybe I don't know what to look for. Also, I am using the search I posted and saving it as an alert. I have attached a screenshot of the settings that I currently have. I have also tried using the scheduled time feature. Neither works.

Re: Alerts when indexing stops

scelikok — Wed, 03 Feb 2021 20:23:34 GMT

Hi @gba8912,

tstats searches cannot run in realtime. You should change your alert schedule to "Scheduled".

Re: Alerts when indexing stops

burwell — Wed, 03 Feb 2021 20:31:31 GMT

Hi. I don't use real time alerting.

Try scheduled. For real-time I can't see the conditions when it would alert.

I will attach to typical kinds of alerting I do (oh only allowed on attachment per reply)..

Either when the result count is greater than 0 (see attachment)
A field has some particular value (for that I do custom and then in the box I literally say

search myfield > 3

Re: Alerts when indexing stops

gba8912 — Thu, 04 Feb 2021 16:27:25 GMT

Thanks! I was able to get the alerts to work with scheduled.