Splunk Alert creation

SureshArja · ‎08-07-2020

Hi Team,

I have a search cluster of 12 nodes and I want to create alert if time gap of "last_conf_replication" is more than one hour.

Can you please advise?

thambisetty · ‎08-07-2020

Can you check it monitoring console -> menu related to search heads and open and see you will find a report that time taken for conf replication in time chart I believe.

or post two sample events and field on which you want to see time difference.

first apply filter to search logs only from 12 hosts

2. convert last_replication_time to epoch

| streamstats range(last_replication_time) as time_diff by host

| where time_diff>3600

————————————
If this helps, give a like below.

richgalloway · ‎08-07-2020

I'm not familiar with that event/metric, but suspect you'll find stats range useful.

---
If this reply helps you, Karma would be appreciated.

Splunk Alert creation

alert action

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation

Splunk Alert creation

alert action

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas