Splunk Search

Splunk Trigger alert no transaction inside log file from the directory?


I have two directory having two log files



The directory have two log files:


Have to trigger alert for the directory and logs have no transaction for 10 min

0 Karma


Can you try this:

|metadata type=sources | eval since=now()-lastTime | search since>=600 | search source="*error.log*" OR source="*systemout.log*" 
0 Karma


Try this:

| stats count 
| eval source="/logs/Test1/error.log, /logs/Test1/systemout.log, /logs/Test2/error.log, /logs/Test2/systemout.log"
| makemv delim="," source 
| mvexpand source 
| append 
    [ search ... whatever search you would use to find these transactions from these files that includes the source] 
| stats sum(eval(if(isnull(_time),0,1))) as count by source
| where count < 1

Then set your alert to look back 10 minutes and trigger condition to Number of Results > 0

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...