Splunk Alert creation

SureshArja · ‎08-07-2020

Hi Team,

I have a search cluster of 12 nodes and I want to create alert if time gap of "last_conf_replication" is more than one hour.

Can you please advise?

thambisetty · ‎08-07-2020

Can you check it monitoring console -> menu related to search heads and open and see you will find a report that time taken for conf replication in time chart I believe.

or post two sample events and field on which you want to see time difference.

first apply filter to search logs only from 12 hosts

2. convert last_replication_time to epoch

| streamstats range(last_replication_time) as time_diff by host

| where time_diff>3600

————————————
If this helps, give a like below.

richgalloway · ‎08-07-2020

I'm not familiar with that event/metric, but suspect you'll find stats range useful.

---
If this reply helps you, Karma would be appreciated.

Splunk Alert creation

alert action

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Join the Conversation

Splunk Alert creation

alert action

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Federated Search for Snowflake Is Now Generally Available on Splunk Cloud Platform

Help Us Build Better Splunk Regex Puzzles (And Win Prizes!)

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station