Splunk Dev

How do I alert to find the creation of a log-file?

abhishekgandhe
Explorer

Hi,

I have a requirement. If a logfile is not created, then Splunk should alert the system.

How can we achieve this?

Thanks

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have your alert search for events from the logfile in question. It should trigger if the number of events found is zero. You'll need to be careful about scheduling the search to allow for natural quiet periods in the log.

index=foo source=logfile
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @abhishekgandhe

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have your alert search for events from the logfile in question. It should trigger if the number of events found is zero. You'll need to be careful about scheduling the search to allow for natural quiet periods in the log.

index=foo source=logfile
---
If this reply helps you, Karma would be appreciated.
0 Karma

abhishekgandhe
Explorer

I want to find whether logfile has 0 events in last 2 hrs. If it has 0 events, that's means no new logs are created in last 2 hrs. If 0 events, then I should alert the system.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You've restated my answer. Does it work?

---
If this reply helps you, Karma would be appreciated.
0 Karma

abhishekgandhe
Explorer

Thanks it worked

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...