Alerting

Alert when Search runs too long

mmcve
Engager

I was wondering if there was a way to have an alert sent to an email address, after a Splunk search has been running for over a certain duration of time?

thomrs
Communicator

Something like this to get you started:

index = _* sourcetype=audittrail  info!=canceled | stats list(info) min(_time) as min max(_time) as max list(total_run_time)  list(search) by search_id user

You can adjust a bit to get your alert.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...