topic Re: Alert not triggering based on tstats results in Alerting

Alert not triggering based on tstats results

rhombus00 — Thu, 16 May 2024 12:40:42 GMT

We've run into a few occassions where one of our network devices stops sending logs to Splunk. I have a tstats search based on the blog post here: https://www.splunk.com/en_us/blog/tips-and-tricks/how-to-determine-when-a-host-stops-sending-logs-to-splunk-expeditiously.html

Here is the search expression I'm using:

| tstats latest(_time) as latest where index=index_name earliest=-1d by host
| eval recent = if(latest > relative_time(now(),"-15m"),1,0), realLatest = strftime(latest,"%c")
| where recent=0

My tstats search does return the hosts that have not sent any logs, but it never triggers when I use this search in an Alert. I noticed that the search only shows the hosts in the Statistics view and there are no Events. Is this why my event is not triggering?

I've found several other examples on this forum of people using tstats to detect when a host stops sending logs. Is there something special they are configuring in their Alert to trigger off of the statistics results?

Re: Alert not triggering based on tstats results

isoutamo — Thu, 16 May 2024 20:18:31 GMT

this should works. Are you sure that you have granted a role which allow you to run alerts?

r. Ismo

Re: Alert not triggering based on tstats results

rhombus00 — Thu, 16 May 2024 20:51:29 GMT

I don't know much about role/permissions but I have created dozens of other alerts. The only difference I can tell is all my other alerts use searches that return events when triggered. This search only returns results in the statistics section.

Re: Alert not triggering based on tstats results

isoutamo — Fri, 17 May 2024 14:02:59 GMT

Ok, then you have that role.

How you have defined this alert? Can you give a screenshot about it?

Re: Alert not triggering based on tstats results

rhombus00 — Wed, 29 May 2024 00:30:29 GMT

You're right that it should work. Thanks for the sanity check.

I deleted the alert and started from scratch and it's working as expected now. I think I messed up the notification settings when I was originally tinkering with it.