Alerting

i want a splunk query for alert , if a event takes more than 30 minutes of time , the alert will trigger, please anyone can guide ?

New Member

In splunk , as one production server many event are occurring everyday so i need a query for splunk to know if any event is taking more than 30 minutes of time, i need a alert for those type of event.

Thank You

Tags (3)
0 Karma

Esteemed Legend

You can do something like this:

| tstats avg(_indextime) AS avg_indextime max(_indextime) AS max_indextime WHERE index=* BY sourcetype host _time
| stats avg(avg_indextime) AS avg_indextime max(max_indextime) AS max_indextime BY sourcetype host
| where ((avg_indextime > 30*60) OR (max_indextime > 30*60))
0 Karma

Splunk Employee
Splunk Employee

So, when you say an event is taking more than 30 minutes, does that mean you have multiple events with the same Subscriber Number or some other unique ID. And I'm assuming there is an event that indicates completion of something (start and stop for example)?

0 Karma

Influencer

@shubham1234 What is the timestamp for events? You can take the difference of index time and subtract it from _time to know if the difference is 30 min or more.

0 Karma

New Member

@Vijeta - i can take the index time , but many request are coming , for example one event is started at 9.00 a.m with one subscriber number and another same event start at 9.30 a.m , but the difference is , this time onother event start with different subscriberNumber( it is a number which is provided to person as a kind of validity) . so if i will use timeStamp , will it work ?

Thank you

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!