Alerting

How to create an email alert if any log file is not updated for 2 days?

ksarode
Explorer

I have created a CSV which contains all the log files that are required. I want to create an alert if any log file is not updated for 2 days.

0 Karma

rojith
New Member

You can create a new alert using Settings > Searching, report and Alert section.
In the alert Serach, you can write a simple Search to get receive data in regard to the logs for the time frame of 2 days.
In the Alert Trigger Condition, check the Number of Results=0
And set the Trigger Action as Email and give the relevant details for the email alerts..

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This won't scale at all.. What happens when you have 100TB/day deployment with millions of logs you're monitoring?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This is going to be difficult to maintain. You should checkout MetaWoot instead

https://splunkbase.splunk.com/app/2949/

0 Karma

ksarode
Explorer

yup i ll try that but if i want to do it by normal method what query i should use

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Once again, your begging for problems by wanting to do it "the normal way". You will have many false alerts, have to maintain a lookup when adding new sources etc..

0 Karma

ksarode
Explorer

ok then i ll install the app and will do that

0 Karma

skoelpin
SplunkTrust
SplunkTrust

MetaWoot can monitor the tsidx files at the host level and make managing this much easier. Please upvote/accept if this answered your question

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...