https://community.splunk.com/t5/Alerting/How-to-find-time-delay-between-one-log/m-p/482315#M8546 <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Alert/CronExpressions">Alert : CronExpressions@splunk&gt;docs</A></P> <P>It is recommended that you set the schedule, search periodically, and fire an alert if there is no log.<BR /> Please refer to the link</P> Mon, 13 Jan 2020 07:12:57 GMT to4kawa 2020-01-13T07:12:57Z https://community.splunk.com/t5/Alerting/How-to-find-time-delay-between-one-log/m-p/482314#M8545 <P>Hi, I'm new to Splunk, I have one log happens frequently, but sometimes log won't come for some short of time. I need to set alert when the log delay happens! how to do that?</P> <P>That event having _time, host, source, and sourceType.</P> Mon, 13 Jan 2020 05:54:52 GMT https://community.splunk.com/t5/Alerting/How-to-find-time-delay-between-one-log/m-p/482314#M8545 muthukumar_covi 2020-01-13T05:54:52Z https://community.splunk.com/t5/Alerting/How-to-find-time-delay-between-one-log/m-p/482315#M8546 <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/Alert/CronExpressions">Alert : CronExpressions@splunk&gt;docs</A></P> <P>It is recommended that you set the schedule, search periodically, and fire an alert if there is no log.<BR /> Please refer to the link</P> Mon, 13 Jan 2020 07:12:57 GMT https://community.splunk.com/t5/Alerting/How-to-find-time-delay-between-one-log/m-p/482315#M8546 to4kawa 2020-01-13T07:12:57Z https://community.splunk.com/t5/Alerting/How-to-find-time-delay-between-one-log/m-p/482316#M8547 <P>Hi,</P> <P>This might help as a starting point. This looks for hosts that we have seen before and lists them if not seen for the last 24hours. It lisst host, sourcetype, index etc. </P> <P>| tstats count as countAtToday latest(<EM>time) as lastTime where index!="*</EM>" by host sourcetype index<BR /> | eval age=now()-lastTime<BR /> | sort age d<BR /> | fieldformat lastTime=strftime(lastTime,"%Y/%m/%d %H:%M:%S") | eval age=round((age/60/60),1)<BR /> | search age&gt;=24<BR /> | eval age=age."hour"<BR /> | dedup host</P> <P>Adjust thresholds and save as an alert. </P> <P>Regards,<BR /> David</P> Mon, 13 Jan 2020 07:15:35 GMT https://community.splunk.com/t5/Alerting/How-to-find-time-delay-between-one-log/m-p/482316#M8547 danan5 2020-01-13T07:15:35Z https://community.splunk.com/t5/Alerting/How-to-find-time-delay-between-one-log/m-p/482317#M8548 <P>It's not working</P> Mon, 13 Jan 2020 07:35:45 GMT https://community.splunk.com/t5/Alerting/How-to-find-time-delay-between-one-log/m-p/482317#M8548 muthukumar_covi 2020-01-13T07:35:45Z