Splunk Dev

How do I alert to find the creation of a log-file?

abhishekgandhe
Explorer

Hi,

I have a requirement. If a logfile is not created, then Splunk should alert the system.

How can we achieve this?

Thanks

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have your alert search for events from the logfile in question. It should trigger if the number of events found is zero. You'll need to be careful about scheduling the search to allow for natural quiet periods in the log.

index=foo source=logfile
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @abhishekgandhe

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have your alert search for events from the logfile in question. It should trigger if the number of events found is zero. You'll need to be careful about scheduling the search to allow for natural quiet periods in the log.

index=foo source=logfile
---
If this reply helps you, Karma would be appreciated.
0 Karma

abhishekgandhe
Explorer

I want to find whether logfile has 0 events in last 2 hrs. If it has 0 events, that's means no new logs are created in last 2 hrs. If 0 events, then I should alert the system.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You've restated my answer. Does it work?

---
If this reply helps you, Karma would be appreciated.
0 Karma

abhishekgandhe
Explorer

Thanks it worked

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...