Getting Data In

Sourcetype Dashboard and/or alert

bluemarvel
Path Finder

need to build an reporting alert that will indicate which sourcetype has stopped as well indicate which server, is there a method in which I can merge the two alerts together, if not then what would be the best approach. (not using Metadata)

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this. Run this for last 24hrs OR last 7 days

| tstats max(_time) as recentTime WHERE index=* by host sourcetype | eval age=now()-recentTime | where age>PutYourThresholdValueInSecHere | eval recentTime=strftime(recentTime,"%+") | eval age=tostring(age,"duration")

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this. Run this for last 24hrs OR last 7 days

| tstats max(_time) as recentTime WHERE index=* by host sourcetype | eval age=now()-recentTime | where age>PutYourThresholdValueInSecHere | eval recentTime=strftime(recentTime,"%+") | eval age=tostring(age,"duration")

View solution in original post

0 Karma

dbcase
Motivator

I think the eval statement should read

eval age=now()-recentTime

0 Karma

bluemarvel
Path Finder

ok I tried this with 45404 sec and added an index, nothing comes up.

tstats max(_time) as recentTime WHERE index=* by host sourcetype | eval age=now()-recentTime | where age>PutYourThresholdValueInSecHere

0 Karma

bluemarvel
Path Finder

I also keep getting the following: "Error in 'tstats' command: This command is not supported in a real-time search"

is there another alternative

0 Karma

dbcase
Motivator

Try putting the values into a table so you can see the age numbers. That way you can gauge what your threshold should be (ballpark)

|tstats max(_time) as recentTime WHERE index=* by host sourcetype | eval age=now()-recentTime | table host, sourcetype, age

You shouldn't have to make this a real time search to be able to alert on it.

0 Karma

bluemarvel
Path Finder

right, I got it to work, thank you. So the next step converting the recent time in a more readable format I.E.: (ddmmyy)

0 Karma

dbcase
Motivator
0 Karma

somesoni2
Revered Legend

I've updated my answer to include the human readable formatting of recentTime and duration.

In one of the comment you mentioned trying to run this as real-time search. If you're planning to do that, I would suggest use the regular search instead with schedule more frequently (say every 5-10 mins or so) if necessary. Real-time searches are expensive and a schedule real-time search never ends and will keep holding on the precious resources.

0 Karma

bluemarvel
Path Finder

ah got it, thank you for that

0 Karma

somesoni2
Revered Legend

It should. Thanks for pointing it out. It's corrected now.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.