Alerting

Real index time alert

cybrtitan
New Member

I understand how to create a real time alert that runs every hour or 5 minutes or whatever, but to my understanding that alert is based on the time stamp on the log we are alerting on. But I have machines that are potentially offline for periods meaning that is possible for that alert to be missed as those logs wouldn't be uploaded until it reconnects to spunk and it is possible for it to miss the alert window.

So would like to use the idea produced in answers 42646

 | eval delay=_indextime-_time | bucket bins=30 delay 

(i can't post links so that's the best i can do)

but i don't understand how to get that working for a alert when most of the time you program the run (kron) time in the GUI and not in the query its self.

0 Karma

acfecondo75
Path Finder

Similar to how you can set earliest and latest in a search query to specify time constraints, you can also specify _index_earliest and _index_latest to specify time constraints based on _indextime. You would still want to schedule the search to run on the same CRON as before.

index=* _index_earliest=-60m _index_latest=now

This search will look only at events that were indexed in the past 60 minutes. Then you set your CRON to 15 * * * * to have it run every hour, fifteen minutes after the hour (or whatever interval you want).

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...