How to create an alert for missing value not present in result that its missing in given threshold time

New Member

How can we set an alert, if from a given list of values- 1 value is not present but in a span of 2 sec we get alert?


index=abc complete ogid| if ogid is missing from list (abc, xyz)

xyz not received in 2-sec threshold get an alert that xyz didn't receive the orderid.

0 Karma

Esteemed Legend

Like this:

index=abc complete ogid=*
| stats count BY ogid
| eval which="data"
| inputlookup append=t <lookup file with every ogid listed on a separate line only once, with only one field named 'ogid'>
| eval which=coalesce(which, "lookup")
| stats values(*) AS * dc(which) AS which_count BY ogid
| where which_count==1 AND which="lookup"
0 Karma

Path Finder

You can try like below query. Run this in some cron schedule. If the number of results is greater than zero set an alert.

index=indexname earliest=-2s  | where ogid !=abc or ogid !=xyz
0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...