Dashboards & Visualizations

How to set cron expresion and time range of alert correctly if event delay in index time

bestSplunker
Contributor

hello everyone:

I have create db connect inputs, It reads record from the database every five minutes to the Splunk index.
but I found that there was a 30 minute difference between index time and event time. as follows:

index = test
|eval indextime=strftime(_indextime,"%Y/%m/%d %H:%M:%S")
|eval age=(_indextime - _time)/60
|table indextime _time age

--------------------------------------------------------------------------------------------------

indextime                                       _time                                            age
2020/02/27  11:40:00                       2020/02/27 11:11:14                                 28.76667
2020/02/27 10: 30:00                       2020/02/27 09: 59:36                                30.40000
2020/02/27 10:25: 00                       2020/02/27 09: 56: 48                               28.20000

now, I want to create an alert to query important events , I hope this alert to run every 10 minutes, so how to set the time range in alert setting correctly, prevent missing important events or repeating alert?

time range:  ???? How to set up correctly

cron expresion :  */10 * * * *
0 Karma
1 Solution

adonio
Ultra Champion

you can use the index time as your search filter:
_index_earliest=-11m@m _index_latest=-1m@m (for example) and you will never miss a bit as long as search doesn't skip
read more here
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/SearchTimeModifiers

View solution in original post

0 Karma

adonio
Ultra Champion

you can use the index time as your search filter:
_index_earliest=-11m@m _index_latest=-1m@m (for example) and you will never miss a bit as long as search doesn't skip
read more here
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/SearchTimeModifiers

0 Karma

bestSplunker
Contributor

thank you very much, so if i use index time, I can ignore time range of the alert settting, because index time in search effect takes precedence over time range?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...