Splunk Alert creation

[SureshArja]

Hi Team,

I have a search cluster of 12 nodes and I want to create alert if time gap  of "last_conf_replication"  is more than one hour. 

Can you please advise?

[thambisetty]

Can you check it monitoring console -> menu related to search heads and open and see you will find a report that time taken for conf replication in time chart I believe.

or post two sample events and field on which you want to see time difference.

first apply filter to search logs only from 12 hosts

2. convert last_replication_time to epoch

| streamstats range(last_replication_time) as time_diff by host

| where time_diff>3600

[richgalloway]

I'm not familiar with that event/metric, but suspect you'll find stats range useful.