Splunk Search

How does the Manager generate index data?

Path Finder

Hello,

Is there a way to create an index alert based on when the last event was received? I see the values I want to check in the Manager > Indexes, but I don't know of an effective way to create a similar search that doesn't have a noticeable performance impact (index=* based searches has a performance impact)

Thanks

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Please try the following search with a small time range, such as Last 15 min;


| dbinspect index=main
| convert timeformat="%m/%d/%Y:%H:%M:%S" mktime(latestTime) AS Last
| eval Diff=now()-Last
| table latestTime Diff Last
| where Diff > 0

Change the threshod in where command, and set the condition to kick your alert.

For more information about each search command, please visit:
http://www.splunk.com/base/Documentation/latest/SearchReference/WhatsInThisManual

View solution in original post

Path Finder

Thanks! This helps immensely (completely glazed over the dbinspect). Gkanapathy, when I try that command, the results are done serially; it stops at the first index and doesn't continue to the others (also tried index=*)

0 Karma

Splunk Employee
Splunk Employee

oh I didn't know you wanted results per index, i though you just wanted the most recent item overall. note that you can also use the |metadata type=sourcetypes command and filter on that output too. dbinspect is probably better for index-level data though.

0 Karma

Splunk Employee
Splunk Employee

You could also do a realtime alert:

index=x OR index=y OR index=z | head 1 | eval d=now()-_time | where d<120

and alert when there are zero results would give you what you need efficiently if you want to be alerted when there wasn't anything for the past two minutes.

Splunk Employee
Splunk Employee

Please try the following search with a small time range, such as Last 15 min;


| dbinspect index=main
| convert timeformat="%m/%d/%Y:%H:%M:%S" mktime(latestTime) AS Last
| eval Diff=now()-Last
| table latestTime Diff Last
| where Diff > 0

Change the threshod in where command, and set the condition to kick your alert.

For more information about each search command, please visit:
http://www.splunk.com/base/Documentation/latest/SearchReference/WhatsInThisManual

View solution in original post