Hi Team,
I have a search cluster of 12 nodes and I want to create alert if time gap of "last_conf_replication" is more than one hour.
Can you please advise?
Can you check it monitoring console -> menu related to search heads and open and see you will find a report that time taken for conf replication in time chart I believe.
or post two sample events and field on which you want to see time difference.
first apply filter to search logs only from 12 hosts
2. convert last_replication_time to epoch
| streamstats range(last_replication_time) as time_diff by host
| where time_diff>3600
I'm not familiar with that event/metric, but suspect you'll find stats range useful.