Getting Data In

monitoring file

Engager

Hi,

I was just wondering if Splunk can be sceheduled to monitor a file regularly, and send out alerts if this file does not get updated for a specific time period , lets say for 5 minutes. Please help me in doing so, if possible.

Thanks, Nitin.

Tags (1)

SplunkTrust
SplunkTrust

Yes, sort-of. I am assuming this file is a logfile, and there are timestamped events in it. If Splunk is indexing this log file you could schedule a saved search with a conditional alert in Splunk that does something like:

source=/path/to/my/log/file host=host.my.logfile.is.on earliest=-5m@m 

And only fires the alert if the results returned are <= 0.

http://www.splunk.com/base/Documentation/latest/Admin/Setupalertsinsavedsearches.conf

Builder

I do that now for several of my log files...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!