topic Help needed with Splunk Search in Alerting

Help needed with Splunk Search

Roy_9 — Wed, 21 Dec 2022 04:48:19 GMT

Hello,

I would like to develop a Splunk alert for one of the source where we are ingesting data using REST API by configuring the scripted input on our Heavy Forwarder, I wanted to set up an email alert when ever there is an interruption in data ingestion from the source.

I am using the below search but not seeing any results.

| tstats latest(_time) as latest where index=XYZ by source | eval recent = if(latest > relative_time(now(),"-10m"),1,0), realLatest = strftime(latest,"%c") | where recent=0

Can someone please help me with the search?

Thanks

Re: Help needed with Splunk Search

Roy_9 — Wed, 21 Dec 2022 00:00:02 GMT

hi @VatsalJagani , do you have any idea on this?

Re: Help needed with Splunk Search

VatsalJagani — Wed, 21 Dec 2022 09:58:17 GMT

@Roy_9

* Do you see any results when you search below result?

| tstats latest(_time) as latest where index=XYZ by source

* Are you running it on Search head and not on heavy forwarder?

* If it's working in normal scenario, then you can append below line and generate error.

* And you can set a schedule alert on this for example for every 1 hour and run it for the last 1 hour time. And this alert will trigger when there will be no event from the given source in last 1 hour.

I hope this helps!!

Re: Help needed with Splunk Search

Roy_9 — Thu, 29 Dec 2022 22:23:31 GMT

No @Anonymous

Currently we are not getting any data for those indexes, i would like to set up an alert in such a way whenever data is being getting indexed to those indexes and during the ingestion if there are any issues.

I created a lookup with the metadata and tweaked the search a little and was able to set it up.