Alerting

Alert period overlap?

cyfj
Explorer

If an alert is scheduled for every 30 minutes to look back 30 minutes, does it search since the last report's idea of what "now" was, or does it just do current "now" minus 30 minutes?

The reason I ask is to know if alert conditions can be missed if they occur JUST AFTER a previous report was run, and CPU utilization or other situation delays the next report from running by a few seconds. If the report just goes back 30 minutes from then execution of the scheduled search, these just-after events would be missed.

Must I take precautions such as looking back 35 minutes for a 30 minute period? What is the behavior for alert conditions that are found in two consecutive scheduled searches?

Thanks!

Tags (1)
0 Karma

Splunk_U
Path Finder

I want to run a particular search on every 15 mins like 9:00, 9:15, 9:30 9:45 in this way. How to do that?

0 Karma

Eqalis
Explorer

Yes if you schedule a search to run every 30 min, it uses the current now each time though in later versions they use cron style timing so it is less of an issue. Splunk recommend allowing a generous 5 min for this in the alert scheduling. So in your case you would run the alert every 30 minutes from 35 min ago until 5 min ago.

If you want the report to show clean half hour blocks, schedule it to run at 5 past and 25 to the hour using custom/cron as

5,35 * * * *

Bob

Eqalis
Explorer

Consecutive searches are not compared unless you chose to alert only if a count rises or drops by a value. So if you are not careful, you will get duplicate data

0 Karma

cyfj
Explorer

Thanks! Is the same entry returned in two consequtive runs treated any differently the second time, related to emailed alerts?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!