Alert not triggering based on tstats results

[rhombus00]

We've run into a few occassions where one of our network devices stops sending logs to Splunk. I have a tstats search based on the blog post here: https://www.splunk.com/en_us/blog/tips-and-tricks/how-to-determine-when-a-host-stops-sending-logs-to...

Here is the search expression I'm using:

| tstats latest(_time) as latest where index=index_name earliest=-1d by host
| eval recent = if(latest > relative_time(now(),"-15m"),1,0), realLatest = strftime(latest,"%c")
| where recent=0

My tstats search does return the hosts that have not sent any logs, but it never triggers when I use this search in an Alert. I noticed that the search only shows the hosts in the Statistics view and there are no Events. Is this why my event is not triggering?

I've found several other examples on this forum of people using tstats to detect when a host stops sending logs. Is there something special they are configuring in their Alert to trigger off of the statistics results?

[isoutamo · Accepted solution]

Hi

this should works. Are you sure that you have granted a role which allow you to run alerts?

r. Ismo

[rhombus00]

You're right that it should work. Thanks for the sanity check.

I deleted the alert and started from scratch and it's working as expected now. I think I messed up the notification settings when I was originally tinkering with it. 

[rhombus00]

I don't know much about role/permissions but I have created dozens of other alerts. The only difference I can tell is all my other alerts use searches that return events when triggered. This search only returns results in the statistics section.

[isoutamo]

Ok, then you have that role.

How you have defined this alert? Can you give a screenshot about it?