Alerting

Timechart alert

novotxms
Loves-to-Learn

I have an alert with timechart span=6h, where I need to check if there is no data for more than 6hours, I need to trigger an alert... How do I get that work?

 

 

Labels (1)
0 Karma

hoaxm3
Explorer

Maybe instead of doing a trending search for no data, look into the metadata command to go by hosts, sourcetype, or source.  Then make your alert based off of the hour last seen. 

| metadata type=sourcetypes index=google
| sort recentTime desc
| convert ctime(recentTime) as Recent_Time
| eval hours_since = round((now() - recentTime) / 3600,2)

 

0 Karma