topic Re: How to create alert if there is no data from an extracted field in Splunk Search

How to create alert if there is no data from an extracted field?

power12 — Tue, 28 Feb 2023 18:55:46 GMT

Hello Splunkers ,

I am trying to schedule an alert when there is no data from a particular field which is extracted field from last 30 minutes.

Below is the sample event

Feb 28 12:49:25 hostabc postfix/smtpd[61995]: connect from host1.abc.local[158.xx.xx]
Feb 28 12:49:25 hostxyz postfix/smtpd[61995]: connect from host2.abc.local[158.xx.xx.xx]
Feb 28 12:49:25 host123 postfix/smtpd[61995]: connect from host3.abc.local158.xx.xx.xxx]

I am using below regex to extract sourcehost which gives me host1.abc.local,host2.abc.local,host3.abc.local
| rex field=_raw ".*from (?<sourcehost>.*)"

I want to create alert when I dont see any events for the last 30 minutes from the source hosts. The alert should say "No data received from <sourcehos> in the last 30 minutes"

Thanks in Advance

Re: How to create alert if there is no data from an extracted field

ITWhisperer — Tue, 28 Feb 2023 18:45:11 GMT

Splunk is good at finding data which is in the logs - it is not so good at finding data which isn't there.

In order to get around this, you need to provide Splunk with a list of everything you are looking for and then see if anything exists in your 30 minute period.

Re: How to create alert if there is no data from an extracted field

power12 — Tue, 28 Feb 2023 19:23:37 GMT

@ITWhisperer Thank you for your reply. I am trying to understand your search what should I do in my case in the search after the append

| append
[ host1.[abc.local],host2.[abc.local],host3.[abc.local]

| eval found=2 ]
| stats sum(found) as found by sourcehost
| where found = 2

I am getting error saying "missing a search command before

Re: How to create alert if there is no data from an extracted field

ITWhisperer — Tue, 28 Feb 2023 19:36:58 GMT

You need to append a search which returns a list of sourcehosts you are interested in. Often people will store this list in a csv store and use inputlookup to retreive it

or they could append the results of a search with a larger timeframe or a search of a summary index for example

or generate some events by hand each time

Re: How to create alert if there is no data from an extracted field

power12 — Tue, 28 Feb 2023 21:42:33 GMT

@ITWhisperer Thank you that worked