Alerting

Alert setup

amirarsalan
Explorer

Hi all!
Want to set up an alert.
I want it to alert when the value is 0 for more than 15 min.
What shall write in cron, earliest etc.
I have the search already.

Thanks in advance

Tags (2)
0 Karma
1 Solution

dindu
Contributor

Hi,

You could give the below conf to achieve the functionality.
Please try and let us know.

   Cron : 0-59/15 * * * *  [Runs a search every 15 min,round the clock - 00,15,30,45 ]
   Earliest : -15m@m [ Give the window of search for the past 15 min ]
   Latest : now

View solution in original post

dindu
Contributor

Hi,

You could give the below conf to achieve the functionality.
Please try and let us know.

   Cron : 0-59/15 * * * *  [Runs a search every 15 min,round the clock - 00,15,30,45 ]
   Earliest : -15m@m [ Give the window of search for the past 15 min ]
   Latest : now

amirarsalan
Explorer

Thank You @dindu

0 Karma

dindu
Contributor

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What you put in the cron, earliest, and latest boxes depends on how often you want your search to run and over what time frame. We need more information.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...