https://community.splunk.com/t5/Alerting/How-to-generate-a-splunk-alert-for-missing-file/m-p/588998#M13593 <P>The answer depends on the results you want.&nbsp; To just find out that a file is missing then count the files you have and alert if that number is less than what is expected.</P><LI-CODE lang="markup">index=foo | stats dc(source) as fileCount | where fileCount &lt; 50</LI-CODE><P>If, OTOH, you need to know <STRONG>which</STRONG> file is missing then you have more work to do.&nbsp;&nbsp;Finding something that is not there is not Splunk's strong suit.&nbsp; See this blog entry for a good write-up on it.<BR /><BR /><A href="https://www.duanewaddle.com/proving-a-negative/" target="_blank">https://www.duanewaddle.com/proving-a-negative/</A></P> Tue, 15 Mar 2022 00:29:39 GMT richgalloway 2022-03-15T00:29:39Z https://community.splunk.com/t5/Alerting/How-to-generate-a-splunk-alert-for-missing-file/m-p/588988#M13592 <P>My requirement is to generate alert if no file received within cut off time for set of files say around 50. I want o avoid creating alert for each file. Please suggest me the best approach</P> Mon, 14 Mar 2022 21:28:01 GMT https://community.splunk.com/t5/Alerting/How-to-generate-a-splunk-alert-for-missing-file/m-p/588988#M13592 pradeepkm 2022-03-14T21:28:01Z https://community.splunk.com/t5/Alerting/How-to-generate-a-splunk-alert-for-missing-file/m-p/588998#M13593 <P>The answer depends on the results you want.&nbsp; To just find out that a file is missing then count the files you have and alert if that number is less than what is expected.</P><LI-CODE lang="markup">index=foo | stats dc(source) as fileCount | where fileCount &lt; 50</LI-CODE><P>If, OTOH, you need to know <STRONG>which</STRONG> file is missing then you have more work to do.&nbsp;&nbsp;Finding something that is not there is not Splunk's strong suit.&nbsp; See this blog entry for a good write-up on it.<BR /><BR /><A href="https://www.duanewaddle.com/proving-a-negative/" target="_blank">https://www.duanewaddle.com/proving-a-negative/</A></P> Tue, 15 Mar 2022 00:29:39 GMT https://community.splunk.com/t5/Alerting/How-to-generate-a-splunk-alert-for-missing-file/m-p/588998#M13593 richgalloway 2022-03-15T00:29:39Z https://community.splunk.com/t5/Alerting/How-to-generate-a-splunk-alert-for-missing-file/m-p/588999#M13594 <P>My use case is I have different file names and I need to alert support team if the particular file not received within cutoff&nbsp;</P> Tue, 15 Mar 2022 01:16:56 GMT https://community.splunk.com/t5/Alerting/How-to-generate-a-splunk-alert-for-missing-file/m-p/588999#M13594 pradeepkm 2022-03-15T01:16:56Z https://community.splunk.com/t5/Alerting/How-to-generate-a-splunk-alert-for-missing-file/m-p/589690#M13621 <P>Thanks the solution in the blog worked.</P> Fri, 18 Mar 2022 12:43:48 GMT https://community.splunk.com/t5/Alerting/How-to-generate-a-splunk-alert-for-missing-file/m-p/589690#M13621 pradeepkm 2022-03-18T12:43:48Z