Alerting

Scheduled alert to retrieve latest event indexed every five minutes

fatjoe
Engager

I have a search query which uses dedup to get the latest event from my source type.

Search:
sourcetype = MonitorLog | dedup Username | WHERE SecondsElapsed >= 300

Username, AllocatedDirectorySize,UsedDirectorySize,PercentageUsage,LatestFileCreationTime,TimeElapsed,SecondsElapsed
amiro,300,314,105%,5/17/2017 12:01:30 PM,"0 days, 0 hours, 7 minutes, 15 seconds",435.0344144
safcom,900,907,101%,5/17/2017 11:50:18 AM,"0 days, 0 hours, 5 minutes, 6 seconds",306.0829872

How do I set up a scheduled alert which will be running this search and trigger alert when event is returned.

I have used the below but its not working.

Earliest: +0m@m
Latest: +5m@m
Cron expression: */5 * * * *

Any suggestions?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Your query gets the latest event for each Username, only if SecondsElapsed > 300. Looks okay.

Your cron setup, however, is looking for every event from the start of this minute to the start of five minutes from now. You are looking for future events.

Try this -

Earliest: -5m@m
Latest: -0m@m
Cron expression: /5 
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Also, it would be worth leaving a couple of minutes in there for indexing to occur.

 Earliest: -7m@m
 Latest: -2m@m
 Cron expression: 2/5 * * * *  

somesoni2
SplunkTrust
SplunkTrust

The full cron will be 2/5 * * * *

DalJeanis
SplunkTrust
SplunkTrust

Yeah, I got lazy...

I hate having to look up whether a particular implementation is five or six slots...

Darn Oracle with their seconds-level precision...even though things seldom run in a second...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...