Dashboards & Visualizations

How to set cron expresion and time range of alert correctly if event delay in index time

bestSplunker
Contributor

hello everyone:

I have create db connect inputs, It reads record from the database every five minutes to the Splunk index.
but I found that there was a 30 minute difference between index time and event time. as follows:

index = test
|eval indextime=strftime(_indextime,"%Y/%m/%d %H:%M:%S")
|eval age=(_indextime - _time)/60
|table indextime _time age

--------------------------------------------------------------------------------------------------

indextime                                       _time                                            age
2020/02/27  11:40:00                       2020/02/27 11:11:14                                 28.76667
2020/02/27 10: 30:00                       2020/02/27 09: 59:36                                30.40000
2020/02/27 10:25: 00                       2020/02/27 09: 56: 48                               28.20000

now, I want to create an alert to query important events , I hope this alert to run every 10 minutes, so how to set the time range in alert setting correctly, prevent missing important events or repeating alert?

time range:  ???? How to set up correctly

cron expresion :  */10 * * * *
0 Karma
1 Solution

adonio
Ultra Champion

you can use the index time as your search filter:
_index_earliest=-11m@m _index_latest=-1m@m (for example) and you will never miss a bit as long as search doesn't skip
read more here
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/SearchTimeModifiers

View solution in original post

0 Karma

adonio
Ultra Champion

you can use the index time as your search filter:
_index_earliest=-11m@m _index_latest=-1m@m (for example) and you will never miss a bit as long as search doesn't skip
read more here
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/SearchTimeModifiers

0 Karma

bestSplunker
Contributor

thank you very much, so if i use index time, I can ignore time range of the alert settting, because index time in search effect takes precedence over time range?

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...