I have data coming into an index that tells me when a load is complete... these files are named *_done.txt
I have data coming into the same index that tells me the counts of errors etc related to the loads.
I want to trigger an alert that contains the errors that occurred in the load but only after the load completes and splunk receives a file with source=*_done.txt.
How can I do this?
[
makeresults count=1
| eval trigger= [ search index=myindexsource=*_done.txt _index_earliest=-1h@h _index_latest=-0h@h | head 1 | stats count | return $count]
| eval search=if( trigger > 0 , "Search to Run if results Count is greater than 0","search to run if results count is not greater than 0, could be null()")
]
I solved with the above
[
makeresults count=1
| eval trigger= [ search index=myindexsource=*_done.txt _index_earliest=-1h@h _index_latest=-0h@h | head 1 | stats count | return $count]
| eval search=if( trigger > 0 , "Search to Run if results Count is greater than 0","search to run if results count is not greater than 0, could be null()")
]
I solved with the above
You can use this approach too:
| where trigger>0
| map search=“search to trigger”