Splunk Dev

How do I alert to find the creation of a log-file?

abhishekgandhe
Explorer

Hi,

I have a requirement. If a logfile is not created, then Splunk should alert the system.

How can we achieve this?

Thanks

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have your alert search for events from the logfile in question. It should trigger if the number of events found is zero. You'll need to be careful about scheduling the search to allow for natural quiet periods in the log.

index=foo source=logfile
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @abhishekgandhe

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have your alert search for events from the logfile in question. It should trigger if the number of events found is zero. You'll need to be careful about scheduling the search to allow for natural quiet periods in the log.

index=foo source=logfile
---
If this reply helps you, Karma would be appreciated.
0 Karma

abhishekgandhe
Explorer

I want to find whether logfile has 0 events in last 2 hrs. If it has 0 events, that's means no new logs are created in last 2 hrs. If 0 events, then I should alert the system.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You've restated my answer. Does it work?

---
If this reply helps you, Karma would be appreciated.
0 Karma

abhishekgandhe
Explorer

Thanks it worked

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...