set an alert if the job doesn't run on particular day

New Member

I want to setup an alert if the job is not running on particular day,
Ex: JOB=ABC123 dint run today i have setup cron to check between 1-2:15 if it is not running in the mentioned time period, Alert should be triggered.

index=abc source=ABC (JOB="AB123" OR JOB="CD345") STATUS="Missed"
| eval "ExecutionTime" = strftime(time,"%I:%M %p")
|stats latest(JOBENDTIME) as ENDTIME latest(STATUS) as STATUS values(JOB) as JOB by ExecutionTime
| eval TC1=if((JOB="AB123" AND ExecutionTime>"02:15 AM") OR STATUS="Missed",1,0)
| eval TC2=if((JOB
NAME="CD345" AND ExecutionTime>"02:10 AM") OR STATUS="Missed",1,0)
| eval Desc=case(TC1="1","Triggering for JOB 123 Failed", TC2="1","Triggering for JOB 234 Failed", 1=1,0)
|search TC1=1 OR TC2=1
|table JOB Desc Execution

Also "Desc" is displaying only "Triggering for JOB 123 Failed" though TC2=1 matches

0 Karma

Re: set an alert if the job doesn't run on particular day


If STATUS is "Missed" then both TC1 and TC2 will be set. The case statement selects the first expression that matches, which is always TC1 in this case.

If this reply helps you, an upvote would be appreciated.
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.