Splunk Dev

How do I alert to find the creation of a log-file?

abhishekgandhe
Explorer

Hi,

I have a requirement. If a logfile is not created, then Splunk should alert the system.

How can we achieve this?

Thanks

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have your alert search for events from the logfile in question. It should trigger if the number of events found is zero. You'll need to be careful about scheduling the search to allow for natural quiet periods in the log.

index=foo source=logfile
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @abhishekgandhe

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have your alert search for events from the logfile in question. It should trigger if the number of events found is zero. You'll need to be careful about scheduling the search to allow for natural quiet periods in the log.

index=foo source=logfile
---
If this reply helps you, Karma would be appreciated.
0 Karma

abhishekgandhe
Explorer

I want to find whether logfile has 0 events in last 2 hrs. If it has 0 events, that's means no new logs are created in last 2 hrs. If 0 events, then I should alert the system.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You've restated my answer. Does it work?

---
If this reply helps you, Karma would be appreciated.
0 Karma

abhishekgandhe
Explorer

Thanks it worked

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...