How to find time delay between one log

[muthukumar_covi]

Hi, I'm new to Splunk, I have one log happens frequently, but sometimes log won't come for some short of time. I need to set alert when the log delay happens! how to do that?

That event having _time, host, source, and sourceType.

[danan5]

Hi,

This might help as a starting point. This looks for hosts that we have seen before and lists them if not seen for the last 24hours. It lisst host, sourcetype, index etc.

| tstats count as countAtToday latest(time) as lastTime where index!="*" by host sourcetype index
| eval age=now()-lastTime
| sort age d
| fieldformat lastTime=strftime(lastTime,"%Y/%m/%d %H:%M:%S") | eval age=round((age/60/60),1)
| search age>=24
| eval age=age."hour"
| dedup host

Adjust thresholds and save as an alert.

Regards,
David

[muthukumar_covi]

It's not working

[to4kawa]

Alert : CronExpressions@splunk>docs

It is recommended that you set the schedule, search periodically, and fire an alert if there is no log.
Please refer to the link