Alerting

Alert setup

Explorer

Hi all!
Want to set up an alert.
I want it to alert when the value is 0 for more than 15 min.
What shall write in cron, earliest etc.
I have the search already.

Thanks in advance

Tags (2)
0 Karma
1 Solution

Contributor

Hi,

You could give the below conf to achieve the functionality.
Please try and let us know.

   Cron : 0-59/15 * * * *  [Runs a search every 15 min,round the clock - 00,15,30,45 ]
   Earliest : -15m@m [ Give the window of search for the past 15 min ]
   Latest : now

View solution in original post

Contributor

Hi,

You could give the below conf to achieve the functionality.
Please try and let us know.

   Cron : 0-59/15 * * * *  [Runs a search every 15 min,round the clock - 00,15,30,45 ]
   Earliest : -15m@m [ Give the window of search for the past 15 min ]
   Latest : now

View solution in original post

Explorer

Thank You @dindu

0 Karma

Contributor

Thanks

0 Karma

SplunkTrust
SplunkTrust

What you put in the cron, earliest, and latest boxes depends on how often you want your search to run and over what time frame. We need more information.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!