Timechart alert

novotxms · ‎03-23-2021

I have an alert with timechart span=6h, where I need to check if there is no data for more than 6hours, I need to trigger an alert... How do I get that work?

hoaxm3 · ‎03-23-2021

Maybe instead of doing a trending search for no data, look into the metadata command to go by hosts, sourcetype, or source. Then make your alert based off of the hour last seen.

| metadata type=sourcetypes index=google
| sort recentTime desc
| convert ctime(recentTime) as Recent_Time
| eval hours_since = round((now() - recentTime) / 3600,2)

Timechart alert

alert action

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Join the Conversation

Timechart alert

alert action

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Add-on for Microsoft Windows 11.0.3: Parse Once, Search Faster

What's New in Splunk Enterprise Security 8.8 and Beyond

A Four-Part Event Series: State of Observability - Where AI Meets Performance