Hi
I have an issue with alerting and its not working anymore, what am i doing wrong?
My Query:
index="content" source="catalina.out" "org.apache.catalina.startup.Catalina.start Server startup" NOT Caesium | rex field=_raw "(?ms)^(?P<boot_end>\\d+\\-\\w+\\-\\d+\\s+\\d+:\\d+)(?:[^ \\n]* ){7}(?P<boot_time>\\d+)" offset_field=_extracted_fields_bounds
| eval epoch_time = _time
| eval boot_sec = boot_time * 0.001
| eval boot_min = boot_sec/60
| eval sub_time = epoch_time - boot_sec
| eval human_epoch_time = strftime(epoch_time,"%y-%m-%d %H:%M:%S")
| eval human_sub_time = strftime(sub_time,"%y-%m-%d %H:%M:%S")
| table human_epoch_time boot_sec boot_min human_sub_time host
Output:
I am not getting the duration anymore
:Alert email that i am getting doesnt contain duration , initiated at :
application has been started on node host.
Start Up Initiated at .
Start Up Completed at 23-04-27 07:46:12 .
Start Up Duration is minutes .
human_epoch_time boot_sec boot_min human_sub_time host
23-04-27 07:46:12 | host |
Does running the alert search manually fetches proper results? Start with this base search and slowly add portions of your search, one at a time, to troubleshoot in which steps extraction/calculations are failing
index="content" source="catalina.out" "org.apache.catalina.startup.Catalina.start Server startup" NOT Caesium
| table _time _raw host