How to find the count of events indexed in the last 10 minutes and send an alert if there is no event count in the last 15 minutes?

[irakeshraut]

Hi

I am trying to find out how many events has been indexed in last 10 minute. I can find out total number of eventcount for index since beginning of time by typing | eventcount index=* but I am not able to find eventcount for last 15 minute. If there is no event count in last 15 minute then I would like to send alert to scoutapp. When i change time on search bar for 15 minutes than i am getting same result as | eventcount index=*

with Regards,
Rakesh

[jayannah]

If your requirement is to send alert if there are no event received on particular index from particular sources, then you can use the following search command
| metadata type=hosts index=myindex

Above command returns the list of hosts sending data to the index "myindex" and when was the last event received. If the last event received timestamp is 15 min earlier to the current time, then you can create the alert.

Hope this information is useful.

[irakeshraut]

Thanks for your answer. I am really new to splunk. Can you please tell me how to

1. Find number of events indexed in last 5 minute.
2. How to find out if splunk is not indexing anything.