Getting Data In

Help in creating alert for sourcetype not receivng data

vrmandadi
Builder

I have an index=pan with three sourcetypes pan:abc , pan:xyz, pan:tuv .
I want to create an alert if I dont receive any data for 15 minutes for a sourcetype .

I used the below query .But the query only works for one sourcetype.I dont want to create multiple alerts for each sourcetype .I want to know if there is a easy way to alert for all the three source types in a single query

| metadata type=sourcetypes index=yourindexNameHere | where sourcetype=yourSourcetypeNameHere| eval age=(recentTime-now()) | where age>900 | table sourcetype recentTime age | convert ctime(recentTime)

Thanks in Advance

0 Karma

to4kawa
Ultra Champion
| metadata type=sourcetypes index=pan | where sourcetype="pan:abc" OR  sourcetype="pan:xyz" OR  sourcetype="pan:tuv"
| eval age=now() - recentTime| where age>900 | table sourcetype recentTime age | convert ctime(recentTime)
|eventstats values(sourcetype) as sourcetypes
|eval sourcetypes=mvjoin(sourcetypes,",")

fire alert with $result.sourcetypes$

hi, @vrmandadi
how about this?

0 Karma

vrmandadi
Builder

I got it
| metadata type=sourcetypes index=pan
| search sourcetype=pan:*
| eval age=(now() -recentTime) | search age>900
| convert ctime(recentTime)
| eval time=strftime(_time,"%d/%m/%Y %H:%M:%S")

to4kawa
Ultra Champion

that's good, please accept the answer.

0 Karma

marycordova
SplunkTrust
SplunkTrust

Have you tried a search instead of where and a wildcard in the sourcetype?

(frankly I forget half the time when/where/why to use "search" vs "where" but if one doesn't work try the other and that usually works 😛 )

| metadata type=sourcetypes index=yourindexNameHere | search sourcetype=pan:*| eval age=(recentTime-now()) | where age>900 | table sourcetype recentTime age | convert ctime(recentTime)

@marycordova
0 Karma

vrmandadi
Builder

Hello @marycordova

Thank you for your reply .I have few questions .The age gives negative values .What does that mean .Should that not be the other way | eval age=(now() -recentTime) and than based on the age value I can create an alert if is greater than 900 for 15 minutes .I am doing something wrong

0 Karma

vrmandadi
Builder

I got it
| metadata type=sourcetypes index=pan
| search sourcetype=pan:*
| eval age=(now() -recentTime) | search age>900
| convert ctime(recentTime)
| eval time=strftime(_time,"%d/%m/%Y %H:%M:%S")

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...