Alerting

Real index time alert

cybrtitan
New Member

I understand how to create a real time alert that runs every hour or 5 minutes or whatever, but to my understanding that alert is based on the time stamp on the log we are alerting on. But I have machines that are potentially offline for periods meaning that is possible for that alert to be missed as those logs wouldn't be uploaded until it reconnects to spunk and it is possible for it to miss the alert window.

So would like to use the idea produced in answers 42646

 | eval delay=_indextime-_time | bucket bins=30 delay 

(i can't post links so that's the best i can do)

but i don't understand how to get that working for a alert when most of the time you program the run (kron) time in the GUI and not in the query its self.

0 Karma

acfecondo75
Path Finder

Similar to how you can set earliest and latest in a search query to specify time constraints, you can also specify _index_earliest and _index_latest to specify time constraints based on _indextime. You would still want to schedule the search to run on the same CRON as before.

index=* _index_earliest=-60m _index_latest=now

This search will look only at events that were indexed in the past 60 minutes. Then you set your CRON to 15 * * * * to have it run every hour, fifteen minutes after the hour (or whatever interval you want).

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...