Why have Indexes stopped logging query/alert?

[Sion2233]

Hi - I am trying to run the below query to help create an alert that will show when we haven't had an alert for a particular index after 15 minutes. I need to make it so it only includes specific indexes rather than all the indexes within Splunk but can't seem to get it right. Any help on how to fix it or letting me know if there is a better way to do this would be massively appreciated!

| tstats latest(_time) as latest where index=* earliest=-24hr by index | eval recent = if(latest > relative_time(now(),"-15m"),1,0), realLatest = strftime(latest,"%c") | rename realLatest as "Last Log" | where recent=0

[isoutamo]

Hi

You have two options:

1. Use some apps like TrackMe https://splunkbase.splunk.com/app/4621/ or Meta Woot https://splunkbase.splunk.com/app/2949/ which can do this and lot more
2. Use your own SPL like @gcusello has instructed on https://community.splunk.com/t5/Alerting/How-to-trigger-an-alert-if-status-event-is-not-indexed-for-... (and couple of other answers 😉

r. Ismo