topic Re: How to create Splunk Alert based on custom condition? in Splunk Search

How to create Splunk Alert based on custom condition?

nilanjankc — Fri, 21 Jun 2019 15:01:10 GMT

New to Splunk, can anyone please help me with the below scenario?

I am receiving events like below:

Event    LastUpdateTime
Event1  21/06/2019 10.05AM
Event2  21/06/2019 10.08AM

I have to create an alert for all those events if my current time(system time) and the LastUpdateTime difference is more than 30 minutes, in this scenario what will be my search string.
It would be a great help if someone can assist me with this.

Nilanjan

Re: How to create Splunk Alert based on custom condition?

somesoni2 — Fri, 21 Jun 2019 15:06:02 GMT

It'll be something like this

your base search to select your data with fields "Event" "LastUpdateTime"
| where now()-strptime('LastUpdateTime',"%d/%m/%Y %H.%M%p") >1800

Re: How to create Splunk Alert based on custom condition?

woodcock — Mon, 24 Jun 2019 00:26:23 GMT

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| eval ago = now() - LastUpdateTime
| where ago >= (30 * 60)