https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-find-deviations-from-normal-behavior-when/m-p/220976#M4051 <P>I have SQL server, where are 6 SQL jobs and it's configured to write events to Windows journal every time when job is finished (it does not matter successfully or unsuccessfully).<BR /> Normal behavior is that events appears every 5 min for one job, 15 min for another, 7 min for another and etc (duration between events can be with a small deviation).</P> <P>But sometimes, jobs can halt for a long time, therefore events will not appear..... </P> <P>I need to setup an alert for such incidents, i.e. find deviation from normal behavior.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2125i36E5E0D628D73BD3/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 15 Nov 2016 19:25:14 GMT DimkoBilanko 2016-11-15T19:25:14Z https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-find-deviations-from-normal-behavior-when/m-p/220976#M4051 <P>I have SQL server, where are 6 SQL jobs and it's configured to write events to Windows journal every time when job is finished (it does not matter successfully or unsuccessfully).<BR /> Normal behavior is that events appears every 5 min for one job, 15 min for another, 7 min for another and etc (duration between events can be with a small deviation).</P> <P>But sometimes, jobs can halt for a long time, therefore events will not appear..... </P> <P>I need to setup an alert for such incidents, i.e. find deviation from normal behavior.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2125i36E5E0D628D73BD3/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 15 Nov 2016 19:25:14 GMT https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-find-deviations-from-normal-behavior-when/m-p/220976#M4051 DimkoBilanko 2016-11-15T19:25:14Z https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-find-deviations-from-normal-behavior-when/m-p/220977#M4052 <P>You can try the following which gives duration in minute for last event received for each SQL Job. You can setup alert for duration &gt; SLA or specific JOB not found in the following result i.e. Number of Results &lt; 6.</P> <PRE><CODE>host=host08 SourceName="SQLAgentHost08" EventCode=208 SQL_JOB_NAME=* | stats count as Count max(_time) as LastReceived by SQL_JOB_NAME | eval LastReceivedTime=strftime(LastReceived,"%Y/%m/%d %H:%M:%S") | eval durInMin=round((now()-LastReceived)/60,1) | fields - LastReceived </CODE></PRE> Wed, 16 Nov 2016 07:01:26 GMT https://community.splunk.com/t5/Alerting/How-to-set-an-alert-to-find-deviations-from-normal-behavior-when/m-p/220977#M4052 niketn 2016-11-16T07:01:26Z