Alerting

Alert setup

amirarsalan
Explorer

Hi all!
Want to set up an alert.
I want it to alert when the value is 0 for more than 15 min.
What shall write in cron, earliest etc.
I have the search already.

Thanks in advance

Tags (2)
0 Karma
1 Solution

dindu
Contributor

Hi,

You could give the below conf to achieve the functionality.
Please try and let us know.

   Cron : 0-59/15 * * * *  [Runs a search every 15 min,round the clock - 00,15,30,45 ]
   Earliest : -15m@m [ Give the window of search for the past 15 min ]
   Latest : now

View solution in original post

dindu
Contributor

Hi,

You could give the below conf to achieve the functionality.
Please try and let us know.

   Cron : 0-59/15 * * * *  [Runs a search every 15 min,round the clock - 00,15,30,45 ]
   Earliest : -15m@m [ Give the window of search for the past 15 min ]
   Latest : now

View solution in original post

amirarsalan
Explorer

Thank You @dindu

0 Karma

dindu
Contributor

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What you put in the cron, earliest, and latest boxes depends on how often you want your search to run and over what time frame. We need more information.

---
If this reply helps you, an upvote would be appreciated.
0 Karma