How to edit my search to alert if there are no events within an hour?

[qiaojing]

Hi,

I'm trying to create an alert that fires if there is no event logged within an hour.

This is my search string:

sourcetype="bn22_epsin" | dedup Cpk_Num | where _time<now()-3600 | table Cpk_Num _time

I think my search string is wrong. I would like to know which carpark did not make any logs in the last hour. My alert will be configured to search every 15 minutes.

Any help will be greatly appreciated. Thank you.

[woodcock]

I think that one of these 2 approaches should work:

https://answers.splunk.com/answers/321170/fill-in-0-if-no-result-is-returned.html
https://answers.splunk.com/answers/293823/how-to-table-list-of-values-from-lookup-not-found.html

[lcrielaa]

It's hard to do without an actual sample and what it would look like but perhaps this would help?

sourcetype="bn22_epsin" earliest=-1h latest=now | dedup Cpk_Num | stats count by Cpk_Num | where count=0

[qiaojing]

@lcrielaa Hi, thanks for your answer, I tried this and no result were returned, I'm suspecting because if there is no log data when count=0 and hence count=0 wont return anything? Any idea?

[sundareshr]

Try this

| metadata type=sourcetypes | where sourcetype="bn22_epsin" AND lasttime<now()-3600

[qiaojing]

@sundareshr could you explain what is the metadata part for? Thank you 🙂

[sundareshr]

The metadata command is a generating command and should be the first command in the search. Generating commands use a leading pipe character. It returns a list of source, sourcetypes, or hosts from a specified index.

[qiaojing]

@sundareshr Oh i see. Can you explain further the difference between using metadata command instead of just searching for sourcetype="" directly?

I tried the above search but no result were returned. Any idea why that's the case?

Thank you so much for your answer 🙂