topic How does the Manager generate index data? in Splunk Search

How does the Manager generate index data?

williamsweat — Thu, 19 May 2011 02:22:34 GMT

Hello,

Is there a way to create an index alert based on when the last event was received? I see the values I want to check in the Manager > Indexes, but I don't know of an effective way to create a similar search that doesn't have a noticeable performance impact (index=* based searches has a performance impact)

Thanks

Re: How does the Manager generate index data?

Masa — Thu, 19 May 2011 03:46:24 GMT

Please try the following search with a small time range, such as Last 15 min;

Change the threshod in where command, and set the condition to kick your alert.

For more information about each search command, please visit:
http://www.splunk.com/base/Documentation/latest/SearchReference/WhatsInThisManual

Re: How does the Manager generate index data?

gkanapathy — Thu, 19 May 2011 05:00:01 GMT

You could also do a realtime alert:

index=x OR index=y OR index=z | head 1 | eval d=now()-_time | where d<120

and alert when there are zero results would give you what you need efficiently if you want to be alerted when there wasn't anything for the past two minutes.

Re: How does the Manager generate index data?

williamsweat — Thu, 19 May 2011 18:08:48 GMT

Thanks! This helps immensely (completely glazed over the dbinspect). Gkanapathy, when I try that command, the results are done serially; it stops at the first index and doesn't continue to the others (also tried index=*)

Re: How does the Manager generate index data?

gkanapathy — Thu, 19 May 2011 19:43:15 GMT

oh I didn't know you wanted results per index, i though you just wanted the most recent item overall. note that you can also use the |metadata type=sourcetypes command and filter on that output too. dbinspect is probably better for index-level data though.