Alerting

Is there a way to trigger a email/alert for when a cron expression time frame has ended and no alerts triggered?

dcephas
Engager

I currently have a search that takes two time/date intervals from the same event and subtracts them to get a value. If that value is longer than one hour an alert will be triggered. In the cron expression I have set the time to run for every day 4am to 12 pm.

What I want to know is if there is a way to also trigger an alert / email if after the alert time frame has past and no alerts were triggered.

The purpose is just to allow me to know there was no issue within that time frame of 4am to 12pm.

Obviously not getting an alert or email should suffice but less technical users would benefit from a confirmation email.

0 Karma

aberkow
Builder

Based on @adonio's idea:

index=_internal savedsearch_id="{savedSearchName}" earliest=-8h result_count>0
| stats count

And alert when the count is 0, running at 12 PM (or whatever time frame you want). Do a fuzzy search for the savedSearchName if you haven't worked with the _internal index before, ours followed something like user;app;name as the format.

Hope this helps!

0 Karma

adonio
Ultra Champion

you can search for the triggered alert for that time frame, do | stats count if count is 0, then no alerts occurred

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...