Splunk Search

How to search and alert if a particular event is not seen within 10 minutes after the previous one?

thippeshaj
Explorer

Hi All

Need your help in writing the search....

In my log, every 10 min I'll get a message like this:

ProcessStartDateTime: 07/12/2015 13:56:02
ProcessEndDateTime: 07/12/2015 13:59:36 

It means process has started and ended, so in the next 10 min's, I should get one more message like that. Sometimes we don't get that message, so it means the next process is not started. If I don't see that message within 10 min, I need to receive an alert. Please help me with writing a search for this.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Search for "ProcessStartDateTime". Schedule the search with cron schedule 0/10 * * * * to get it to run every 10 minutes. Set the Alert condition to "if number of events", "is equal to", and "0". Check the Enable box under "Send email" and fill in the appropriate boxes. Click Save and you'll get an email whenever the search doesn't find an event with "ProcessStartDateTime" in it. It's not pretty, but it will work.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...