https://community.splunk.com/t5/Alerting/How-do-I-configure-an-alert-for-missing-files-from-different/m-p/417604#M7276 <P>Hi,</P> <P>as a simple first approach it could be enough to:</P> <OL> <LI>set your time range to the last hour an</LI> <LI>extract the filename with help of regex if not already done</LI> <LI>do a | stats count by filename</LI> </OL> <P>The result should always be 2 if every file is present in both directories. If it is not 2, you could trigger your alert.</P> <P>Greetings</P> <P>Tom</P> Mon, 03 Dec 2018 09:29:16 GMT tom_frotscher 2018-12-03T09:29:16Z https://community.splunk.com/t5/Alerting/How-do-I-configure-an-alert-for-missing-files-from-different/m-p/417603#M7275 <P>Hi all,</P> <P>I need help creating an alert for the difference of 2 directories. Let's say: sender directory has files 4 but receiver directory has 2. Now, I need to configure an alert for 2 missing files with names/details from receiver directory.</P> <P>Getting the below outputs from each directory on a scheduled basis (1hr), I need to compare 2 directories and get the output for the missing file names and trigger an alert.</P> <P>Sender Directory<BR /> [root] ➤ ls -l<BR /> total 0<BR /> -rwx------ 1 Users UsersGrp 0 Dec 3 13:16 file1.txt<BR /> -rwx------ 1 Users UsersGrp 0 Dec 3 13:16 file2.txt<BR /> -rwx------ 1 Users UsersGrp 0 Dec 3 13:16 file3.txt<BR /> -rwx------ 1 Users UsersGrp 0 Dec 3 13:16 file4.txt</P> <P>Receiver Directory<BR /> [root] ➤ ls -l<BR /> total 0<BR /> -rwx------ 1 Users UsersGrp 0 Dec 3 13:16 file1.txt<BR /> -rwx------ 1 Users UsersGrp 0 Dec 3 13:16 file2.txt</P> <P>Please help me with queries to configure alert.</P> <P>Thanks in advance!</P> Mon, 03 Dec 2018 08:25:08 GMT https://community.splunk.com/t5/Alerting/How-do-I-configure-an-alert-for-missing-files-from-different/m-p/417603#M7275 kpavan 2018-12-03T08:25:08Z https://community.splunk.com/t5/Alerting/How-do-I-configure-an-alert-for-missing-files-from-different/m-p/417604#M7276 <P>Hi,</P> <P>as a simple first approach it could be enough to:</P> <OL> <LI>set your time range to the last hour an</LI> <LI>extract the filename with help of regex if not already done</LI> <LI>do a | stats count by filename</LI> </OL> <P>The result should always be 2 if every file is present in both directories. If it is not 2, you could trigger your alert.</P> <P>Greetings</P> <P>Tom</P> Mon, 03 Dec 2018 09:29:16 GMT https://community.splunk.com/t5/Alerting/How-do-I-configure-an-alert-for-missing-files-from-different/m-p/417604#M7276 tom_frotscher 2018-12-03T09:29:16Z