Splunk Search
Highlighted

To set an alert if a field doesn't exist in log messages in real time

Communicator

I'm trying to set up a alert If I don't see a log message with in 15 minutes span of time.
I extracted a filed from the log message but I'm not sure how to check for the field in real time .

The query i tired is

index= "metering" host="vm10190" sourcetype="ping" | rex "Ping response: (?.)" | search PingMessage="OK*" | bucket _time span=15m | stats count by _time host | where count<1

Any help would be greatly appreciated .

Tags (3)
0 Karma
Highlighted

Re: To set an alert if a field doesn't exist in log messages in real time

Contributor

For alerting, you need to setup a save search and schedule it. Then, you can alert based on the results of the saved search. Is the search above your saved search?

0 Karma
Highlighted

Re: To set an alert if a field doesn't exist in log messages in real time

Communicator

Yes, It is a saved search but it is incorrect and it is not returning any results

0 Karma
Highlighted

Re: To set an alert if a field doesn't exist in log messages in real time

SplunkTrust
SplunkTrust

Create a search that finds your log messages. Then schedule that search and have it send an alert if the event count = 0.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: To set an alert if a field doesn't exist in log messages in real time

Communicator

I am not sure how to create a search query to return the results for just last 15 minutes

0 Karma
Highlighted

Re: To set an alert if a field doesn't exist in log messages in real time

SplunkTrust
SplunkTrust

Include 'earliest=-15m' in your search query.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: To set an alert if a field doesn't exist in log messages in real time

Communicator

index= "metering" sourcetype="ping" | rex "Ping response: (?.)" | search PingMessage=":OK*"

this query returns me the results where the ping is ok
but when I add the time it doesn't return any results

0 Karma
Highlighted

Re: To set an alert if a field doesn't exist in log messages in real time

SplunkTrust
SplunkTrust

Are you sure there were results in the last 15 minutes?

Did you specify the time as 'index= "metering" sourcetype="ping" earliest=-15m | rex "Ping response: (?.)" | search PingMessage=":OK*" ' ?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: To set an alert if a field doesn't exist in log messages in real time

Communicator

I do get the results now can you please let me know how to use the eventcount in this case

0 Karma
Highlighted

Re: To set an alert if a field doesn't exist in log messages in real time

SplunkTrust
SplunkTrust

Go to the 'Searches and Reports' manager page and click the New button. Enter your search query in the Search box, start time of '-15m' and end time of 'now'. Check the 'Schedule this search' box. Choose "15 minutes" from the 'Run every' box. Under Condition, choose 'if number of events' and 'is equal to' from the respective drop-downs.

Choose the alert action and save the search.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.