topic Re: Splunk Alert creation in Alerting

Splunk Alert creation

SureshArja — Fri, 07 Aug 2020 11:22:05 GMT

Hi Team,

I have a search cluster of 12 nodes and I want to create alert if time gap of "last_conf_replication" is more than one hour.

Can you please advise?

Re: Splunk Alert creation

richgalloway — Fri, 07 Aug 2020 13:39:06 GMT

I'm not familiar with that event/metric, but suspect you'll find stats range useful.

Re: Splunk Alert creation

thambisetty — Fri, 07 Aug 2020 16:00:18 GMT

Can you check it monitoring console -> menu related to search heads and open and see you will find a report that time taken for conf replication in time chart I believe.

or post two sample events and field on which you want to see time difference.

first apply filter to search logs only from 12 hosts

2. convert last_replication_time to epoch

| streamstats range(last_replication_time) as time_diff by host

| where time_diff>3600