How to alert only when a file exists

[yazapage]

I need to set up a search to send an alert only when an error log is generated. Under normal operation a daily log file would not exist in the directory. If the app gets an error generated, then it will create a logfile with the date appended.

[Lowell]

Assuming that the error log is being indexed by Splunk and that the timestamps are correct, then you really should be able to just search for the time range of the last day and see if any events were created for a "source" pattern that matches your log files.

For example, lets say your log is called: /var/log/myapp-error.2011-10-07

Then this simple search should do the trick:

source=/var/log/myapp-error* earliest=-1d@d

But if you need to actually check on the timestamp within the file name for some reason (like your log doesn't have properly timestamps, or timestamps in the past), then should be able to extract out the date from the "source" (log file name), and do something like this:

source=/var/log/myapp-error* | rex field=source "error-(?<log_date>\d{4}-\d{2}\d{2})" | eval todays_date=strftime(time(), "%Y-%m-%d") | where log_date=todays_date

[syedikramulla]

Hi Lowell,

I have a slightly different requirement.  My application will generate log file every week day in the format App_YYYYMMDD.log.  I want to write a query  to monitor the log file creation every week day and create an alert when the log file is not generated.   I also want the query to wait for some time, let's say 8 hours from the start of the day (12 AM), before generating an alert.

Can you please share query for the same.

Regards,

Syed