Alert query not triggering an alert

Nidd — Wed, 18 Aug 2021 11:31:15 GMT

Hi, I have a sample log like below, for which I have created an alert which triggers if the Expiration Date is greater than current date.

LOGS:

Date : 17/08/2021 12:15:44 Build Number : 3274 Database Date : 2021-07-15 Expiration Date : 2021-08-17 License Expiration Date : 2021-08-17

MY QUERY:

index=myIdx source="/my/logs/catalina.out" linecount=4 | regex _raw = ".*\sExpiration Date\s.*" | rex max_match=0 "^(?<lines>.+)\n+" | eval buildNumber=mvindex(lines,0) | eval expirationDate=mvindex(lines,2) | fields - lines | eval expirationDateVal = mvindex(split(expirationDate,":"),1) | eval buildNumberVal = mvindex(split(buildNumber,":"),1) | eval expiredConvert = strptime(expirationDateVal,"%m-%d-%Y") |eval expiredConvertDiffFormat = strptime(expirationDateVal,"%Y-%m-%d") | eval remDays =round((expiredConvert-now())/86400) | eval remDaysDiffFormat =round((expiredConvertDiffFormat-now())/86400) | where ( remDays <= 15 and remDays != "" ) or ( remDaysDiffFormat !="" and remDaysDiffFormat <= 15 ) | rename remDays as numDays remDaysDiffFormat as numDaysDiffFormat host as host |eval remainingDays =case(numDays!="",numDays,numDaysDiffFormat!="",numDaysDiffFormat)| where remainingDays > 0 | table remainingDays,host,buildNumberVal,expirationDate

Somehow, this query is not pulling up the logs. Is there something which I am missing in my query? The alert should have triggered yesterday. But it hasn't. Kindly help.

Thanks in advance.

Re: Alert query not triggering an alert

richgalloway — Wed, 18 Aug 2021 12:53:59 GMT

Debug the query by running it one pipe at a time until you find where it fails to return results.

Are you sure you have the math right? Perhaps you mean < rather than > ?

topic Re: Alert query not triggering an alert in Alerting

Alert query not triggering an alert

Re: Alert query not triggering an alert