How to trigger an alert if http _status code =200 is not reported in logs for any host from last 15 mins ?

[nilbak1]

How to trigger an alert if http _status code =200 is not reported in logs for any host from last 15 mins ?

[nilbak1 · Accepted solution]

Hi @richgalloway
yes, I have been able to create the query for the alert,
I have imported lookupfile where I mentioned hosts and their count as 0 and append this with my main query and getting the desired result.
Anyways thanks for your input 🙂

[richgalloway]

If you mean no host has reported code 200 then run a search over the last 15 minutes looking for http_status=200. Trigger an alert if the number of results is zero.
For any single host, it's more complex because Splunk will find hosts that have reported, but cannot find those which have not (you can't search for something that doesn't exist). The solution is to have a list of hosts and compare that list to the list of hosts which have reported code 200. Trigger an alert when the two lists don't match.