Dashboards & Visualizations

How to create a search that will send an alert when the feed has been delayed for >=70min?

troy44112
Explorer

I am looking to create a search that will send an alert when the feed has been delayed for >=70min

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's not a lot to work with.  What do you mean by "the feed"?  Do you have only one input to Splunk?

Assuming you can define the feed to a specific index (and, optionally, host and/or source and/or sourcetype) then this may help.

index=foo host=bar source=baz sourcetype=foobar earliest=-70m
| stats count

And trigger the alert if the number of results is zero.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...