Alerting

Scheduled alert to retrieve latest event indexed every five minutes

fatjoe
Engager

I have a search query which uses dedup to get the latest event from my source type.

Search:
sourcetype = MonitorLog | dedup Username | WHERE SecondsElapsed >= 300

Username, AllocatedDirectorySize,UsedDirectorySize,PercentageUsage,LatestFileCreationTime,TimeElapsed,SecondsElapsed
amiro,300,314,105%,5/17/2017 12:01:30 PM,"0 days, 0 hours, 7 minutes, 15 seconds",435.0344144
safcom,900,907,101%,5/17/2017 11:50:18 AM,"0 days, 0 hours, 5 minutes, 6 seconds",306.0829872

How do I set up a scheduled alert which will be running this search and trigger alert when event is returned.

I have used the below but its not working.

Earliest: +0m@m
Latest: +5m@m
Cron expression: */5 * * * *

Any suggestions?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Your query gets the latest event for each Username, only if SecondsElapsed > 300. Looks okay.

Your cron setup, however, is looking for every event from the start of this minute to the start of five minutes from now. You are looking for future events.

Try this -

Earliest: -5m@m
Latest: -0m@m
Cron expression: /5 
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Also, it would be worth leaving a couple of minutes in there for indexing to occur.

 Earliest: -7m@m
 Latest: -2m@m
 Cron expression: 2/5 * * * *  

somesoni2
Revered Legend

The full cron will be 2/5 * * * *

DalJeanis
SplunkTrust
SplunkTrust

Yeah, I got lazy...

I hate having to look up whether a particular implementation is five or six slots...

Darn Oracle with their seconds-level precision...even though things seldom run in a second...

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.