Alerting

How to generate a splunk alert for missing file?

pradeepkm
Explorer

My requirement is to generate alert if no file received within cut off time for set of files say around 50. I want o avoid creating alert for each file. Please suggest me the best approach

Labels (3)
Tags (2)
0 Karma
1 Solution

pradeepkm
Explorer

Thanks the solution in the blog worked.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The answer depends on the results you want.  To just find out that a file is missing then count the files you have and alert if that number is less than what is expected.

index=foo
| stats dc(source) as fileCount
| where fileCount < 50

If, OTOH, you need to know which file is missing then you have more work to do.  Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.

pradeepkm
Explorer

Thanks the solution in the blog worked.

0 Karma

pradeepkm
Explorer

My use case is I have different file names and I need to alert support team if the particular file not received within cutoff 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...