Alerting

Custom alert trigger condition for passing time amount

ryhluc01
Communicator

Hi all,

I need to set up an alert condition to notify me if the report doesn't generate data for more than 5 minute's

stats max(_time) as "Last Report Run" by reltime|dedup "Last Report Run" |convert timeformat=%l:%M%p ctime("Last Report Run")|rename reltime as "Time Since Last Report"|sort -"Time Since Last Report"

0 Karma
1 Solution

ryhluc01
Communicator

Answering my own question: This result can be achieved by specifying the number or results as the trigger condition.

View solution in original post

0 Karma

ryhluc01
Communicator

Answering my own question: This result can be achieved by specifying the number or results as the trigger condition.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@ryhluc01 If your problem is resolved, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!