Getting Data In

Sourcetype Dashboard and/or alert

bluemarvel
Path Finder

need to build an reporting alert that will indicate which sourcetype has stopped as well indicate which server, is there a method in which I can merge the two alerts together, if not then what would be the best approach. (not using Metadata)

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this. Run this for last 24hrs OR last 7 days

| tstats max(_time) as recentTime WHERE index=* by host sourcetype | eval age=now()-recentTime | where age>PutYourThresholdValueInSecHere | eval recentTime=strftime(recentTime,"%+") | eval age=tostring(age,"duration")

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this. Run this for last 24hrs OR last 7 days

| tstats max(_time) as recentTime WHERE index=* by host sourcetype | eval age=now()-recentTime | where age>PutYourThresholdValueInSecHere | eval recentTime=strftime(recentTime,"%+") | eval age=tostring(age,"duration")
0 Karma

dbcase
Motivator

I think the eval statement should read

eval age=now()-recentTime

0 Karma

bluemarvel
Path Finder

ok I tried this with 45404 sec and added an index, nothing comes up.

tstats max(_time) as recentTime WHERE index=* by host sourcetype | eval age=now()-recentTime | where age>PutYourThresholdValueInSecHere

0 Karma

bluemarvel
Path Finder

I also keep getting the following: "Error in 'tstats' command: This command is not supported in a real-time search"

is there another alternative

0 Karma

dbcase
Motivator

Try putting the values into a table so you can see the age numbers. That way you can gauge what your threshold should be (ballpark)

|tstats max(_time) as recentTime WHERE index=* by host sourcetype | eval age=now()-recentTime | table host, sourcetype, age

You shouldn't have to make this a real time search to be able to alert on it.

0 Karma

bluemarvel
Path Finder

right, I got it to work, thank you. So the next step converting the recent time in a more readable format I.E.: (ddmmyy)

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I've updated my answer to include the human readable formatting of recentTime and duration.

In one of the comment you mentioned trying to run this as real-time search. If you're planning to do that, I would suggest use the regular search instead with schedule more frequently (say every 5-10 mins or so) if necessary. Real-time searches are expensive and a schedule real-time search never ends and will keep holding on the precious resources.

0 Karma

bluemarvel
Path Finder

ah got it, thank you for that

0 Karma

somesoni2
SplunkTrust
SplunkTrust

It should. Thanks for pointing it out. It's corrected now.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...