Getting Data In

How to Monitor the latest timestamp of the log file using source?

Amit79
Loves-to-Learn Everything

Below is my log file details

index="idx_rwmsna" sourcetype=st_rwmsna_printactivity source="E:\\Busapps\\rwms\\mna1\\geodev12\\Edition\\logs\\DEFAULT_activity_1.log"

I tried multiple ways but I am unable to make this work using below splunk query appreciate response on this

| tstats latest(_time) as updated_time where index="idx_rwmsna" source="E:\\Busapps\\rwms\\mna1\\geodev12\\Edition\\logs\\DEFAULT_activity_1.log" host=ATLWMSVP44
| eval status=if(updated_time>(now()-60),"ko","ok")

The problem is with above query, if file updation stopped before the triggering time of the alert its not fetching the updated_time and its not processing further.

Can someone please help how to handle this , please consider this on priority

Regards

Amit

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Amit79,

what's the difference (but the title) of your previous question at https://community.splunk.com/t5/Alerting/Need-help-with-alert/m-p/649714#M15194?

Ciao.

Giuseppe

0 Karma

Amit79
Loves-to-Learn Everything

Hello Sir,

I have put the details in this post and why this splunk query is not working for me.

I am trying to see if for this case alert generation is possible or no ?

If its possible please let me know how can I do it.

Regards

Amit

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Amit79,

they seem to be the same!

Anyway, did yu tested my solution in the other amswer?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...