topic Re: Create Alert if condition is met? in Splunk Search

Create Alert if condition is met?

Chinni611 — Thu, 27 Oct 2022 00:38:34 GMT

Hi ,

I have a scenario where the files needs to be transferred for both inbound and outbound at 2 am daily.

I need to create an alert when files are present in inbound by 2 am but missing in outbound by 2 am .

Here is my query below. please help

index=cas source="/bin/var/logs/log" File 1OR File 2 OR File 3 OR File 4 Inbound

for outbound condition is to change to outbound and File 1 represents the file that is getting transferred

Re: Create Alert if condition is met?

johnhuang — Thu, 27 Oct 2022 01:01:45 GMT

Could you provide some sample data?

Re: Create Alert if condition is met?

gcusello — Thu, 27 Oct 2022 06:47:33 GMT

Hi @Chinni611,

could you better describe how to recognize inbound from outbound?

in oher words; is there a string in one event? or there's a file with a different name?

Ciao.

Giuseppe

Re: Create Alert if condition is met?

Chinni611 — Thu, 27 Oct 2022 14:08:19 GMT

differentiation is just by IP address for inbound (x.x.x) or not api - outbound is api.com address .File is same ( file is getting transported to both the places first inbound and later outbound) we need to track if file is present in inbound but missing in outbound at 2:01 am daily