Alerting

How to find the count of events indexed in the last 10 minutes and send an alert if there is no event count in the last 15 minutes?

irakeshraut
New Member

Hi

I am trying to find out how many events has been indexed in last 10 minute. I can find out total number of eventcount for index since beginning of time by typing | eventcount index=* but I am not able to find eventcount for last 15 minute. If there is no event count in last 15 minute then I would like to send alert to scoutapp. When i change time on search bar for 15 minutes than i am getting same result as | eventcount index=*

with Regards,
Rakesh

0 Karma

jayannah
Builder

If your requirement is to send alert if there are no event received on particular index from particular sources, then you can use the following search command
| metadata type=hosts index=myindex

Above command returns the list of hosts sending data to the index "myindex" and when was the last event received. If the last event received timestamp is 15 min earlier to the current time, then you can create the alert.

Hope this information is useful.

0 Karma

irakeshraut
New Member

Thanks for your answer. I am really new to splunk. Can you please tell me how to

  1. Find number of events indexed in last 5 minute.
  2. How to find out if splunk is not indexing anything.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!