Splunk Search

How to search and alert if a particular event is not seen within 10 minutes after the previous one?

thippeshaj
Explorer

Hi All

Need your help in writing the search....

In my log, every 10 min I'll get a message like this:

ProcessStartDateTime: 07/12/2015 13:56:02
ProcessEndDateTime: 07/12/2015 13:59:36 

It means process has started and ended, so in the next 10 min's, I should get one more message like that. Sometimes we don't get that message, so it means the next process is not started. If I don't see that message within 10 min, I need to receive an alert. Please help me with writing a search for this.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Search for "ProcessStartDateTime". Schedule the search with cron schedule 0/10 * * * * to get it to run every 10 minutes. Set the Alert condition to "if number of events", "is equal to", and "0". Check the Enable box under "Send email" and fill in the appropriate boxes. Click Save and you'll get an email whenever the search doesn't find an event with "ProcessStartDateTime" in it. It's not pretty, but it will work.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...