Splunk Search

Create Saved Search For A Files Time Stamp

New Member

Splunk univerisal forwarder is installed on a linux server. This server is indexing a number of files. I need to create a Saved Search to search on the time stamp of two of the files. If the time stamp of the files is 20 minutes old then it tells me a process is not running on the Linux server.

Would anyone know how to create such a saved search.

Tags (2)
0 Karma

Esteemed Legend

You can look at _indextime to see when the file was forwarded but the only way to get the timestamp of the file is if it is encoded in the filename or in data inside the file. But you could do something like this

index=myIndex (source=source1 OR source=source2) | stats latest(_time) AS latestTime BY source | eval waitingSecs = now() -  latestTime | where watingSecs > 1200

Then save this search as an alert and run it every X minutes for the last hour (-1h) and have it email you whenever numevents>0.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...