Getting Data In

How to Monitor the latest timestamp of the log file using source?

Amit79
Loves-to-Learn Everything

Below is my log file details

index="idx_rwmsna" sourcetype=st_rwmsna_printactivity source="E:\\Busapps\\rwms\\mna1\\geodev12\\Edition\\logs\\DEFAULT_activity_1.log"

I tried multiple ways but I am unable to make this work using below splunk query appreciate response on this

| tstats latest(_time) as updated_time where index="idx_rwmsna" source="E:\\Busapps\\rwms\\mna1\\geodev12\\Edition\\logs\\DEFAULT_activity_1.log" host=ATLWMSVP44
| eval status=if(updated_time>(now()-60),"ko","ok")

The problem is with above query, if file updation stopped before the triggering time of the alert its not fetching the updated_time and its not processing further.

Can someone please help how to handle this , please consider this on priority

Regards

Amit

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Amit79,

what's the difference (but the title) of your previous question at https://community.splunk.com/t5/Alerting/Need-help-with-alert/m-p/649714#M15194?

Ciao.

Giuseppe

0 Karma

Amit79
Loves-to-Learn Everything

Hello Sir,

I have put the details in this post and why this splunk query is not working for me.

I am trying to see if for this case alert generation is possible or no ?

If its possible please let me know how can I do it.

Regards

Amit

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Amit79,

they seem to be the same!

Anyway, did yu tested my solution in the other amswer?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...