Getting Data In

How to alert if the last indexed log from a host is older than 15 mins from the search time?


I have a requirement where a log file from my application hosts will get updated every 15 mins if the application is healthy. But there wont be any logs updated if there is any issue with the application. So wanted an alert from each host if the last indexed log from any host is more than 15 mins old. Appreciated any thoughts on it.

0 Karma

Ultra Champion

The easiest way is to use the metadata command

|metadata type=hosts index=*|eval threshold=now()-900|where lastTime<threshold|eval lastEvent=strftime(lastTime, "%Y-%m-%d %H:%M:%S"|table host lastEvent
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...