Hi, I'm new to Splunk, I have one log happens frequently, but sometimes log won't come for some short of time. I need to set alert when the log delay happens! how to do that?
That event having _time, host, source, and sourceType.
This might help as a starting point. This looks for hosts that we have seen before and lists them if not seen for the last 24hours. It lisst host, sourcetype, index etc.
| tstats count as countAtToday latest(time) as lastTime where index!="*" by host sourcetype index
| eval age=now()-lastTime
| sort age d
| fieldformat lastTime=strftime(lastTime,"%Y/%m/%d %H:%M:%S") | eval age=round((age/60/60),1)
| search age>=24
| eval age=age."hour"
| dedup host
Adjust thresholds and save as an alert.
It's not working
Alert : CronExpressions@splunk>docs
It is recommended that you set the schedule, search periodically, and fire an alert if there is no log.
Please refer to the link