Splunk Search

How does the Manager generate index data?

williamsweat
Path Finder

Hello,

Is there a way to create an index alert based on when the last event was received? I see the values I want to check in the Manager > Indexes, but I don't know of an effective way to create a similar search that doesn't have a noticeable performance impact (index=* based searches has a performance impact)

Thanks

0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

Please try the following search with a small time range, such as Last 15 min;


| dbinspect index=main
| convert timeformat="%m/%d/%Y:%H:%M:%S" mktime(latestTime) AS Last
| eval Diff=now()-Last
| table latestTime Diff Last
| where Diff > 0

Change the threshod in where command, and set the condition to kick your alert.

For more information about each search command, please visit:
http://www.splunk.com/base/Documentation/latest/SearchReference/WhatsInThisManual

View solution in original post

williamsweat
Path Finder

Thanks! This helps immensely (completely glazed over the dbinspect). Gkanapathy, when I try that command, the results are done serially; it stops at the first index and doesn't continue to the others (also tried index=*)

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

oh I didn't know you wanted results per index, i though you just wanted the most recent item overall. note that you can also use the |metadata type=sourcetypes command and filter on that output too. dbinspect is probably better for index-level data though.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You could also do a realtime alert:

index=x OR index=y OR index=z | head 1 | eval d=now()-_time | where d<120

and alert when there are zero results would give you what you need efficiently if you want to be alerted when there wasn't anything for the past two minutes.

Masa
Splunk Employee
Splunk Employee

Please try the following search with a small time range, such as Last 15 min;


| dbinspect index=main
| convert timeformat="%m/%d/%Y:%H:%M:%S" mktime(latestTime) AS Last
| eval Diff=now()-Last
| table latestTime Diff Last
| where Diff > 0

Change the threshod in where command, and set the condition to kick your alert.

For more information about each search command, please visit:
http://www.splunk.com/base/Documentation/latest/SearchReference/WhatsInThisManual

Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...