Alerting

Real index time alert

cybrtitan
New Member

I understand how to create a real time alert that runs every hour or 5 minutes or whatever, but to my understanding that alert is based on the time stamp on the log we are alerting on. But I have machines that are potentially offline for periods meaning that is possible for that alert to be missed as those logs wouldn't be uploaded until it reconnects to spunk and it is possible for it to miss the alert window.

So would like to use the idea produced in answers 42646

 | eval delay=_indextime-_time | bucket bins=30 delay 

(i can't post links so that's the best i can do)

but i don't understand how to get that working for a alert when most of the time you program the run (kron) time in the GUI and not in the query its self.

0 Karma

acfecondo75
Path Finder

Similar to how you can set earliest and latest in a search query to specify time constraints, you can also specify _index_earliest and _index_latest to specify time constraints based on _indextime. You would still want to schedule the search to run on the same CRON as before.

index=* _index_earliest=-60m _index_latest=now

This search will look only at events that were indexed in the past 60 minutes. Then you set your CRON to 15 * * * * to have it run every hour, fifteen minutes after the hour (or whatever interval you want).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...