i have one server having four nodes.how to write alert query for nodes have no transaction for 5 min and trigger alert email in splunk?

[karthi2809]

I have one server having four nodes.how to write alert query for nodes have no transaction for 5 min and trigger alert email in splunk?

[woodcock]

I do not understand what you mean; it might help to add more detail and restate things. Show sample events and a mockup of desired output.

[dineshraj9]

You can extract the node name and use that in the alert query -

index=<your_index> host=<your_host> | stats count by node_name 

And set trigger condition as "if number of results less than 4" then alert.

If you want to explicitly know which node is down, then have the four node names in the alert mailer description.

[adonio]

can you kindly elaborate and / or share data sample?
if we assume that each node has a unique source (or other unique field), you can create a search that counts by source and if count is = 0 then alert on that particular node

   index = whatever UniqueField = * | stats count by UniqueField