Create Saved Search For A Files Time Stamp

[itsquinj]

Splunk univerisal forwarder is installed on a linux server. This server is indexing a number of files. I need to create a Saved Search to search on the time stamp of two of the files. If the time stamp of the files is 20 minutes old then it tells me a process is not running on the Linux server.

Would anyone know how to create such a saved search.

[woodcock]

You can look at _indextime to see when the file was forwarded but the only way to get the timestamp of the file is if it is encoded in the filename or in data inside the file. But you could do something like this

index=myIndex (source=source1 OR source=source2) | stats latest(_time) AS latestTime BY source | eval waitingSecs = now() -  latestTime | where watingSecs > 1200

Then save this search as an alert and run it every X minutes for the last hour (-1h) and have it email you whenever numevents>0.