Splunk Search

searching for non running programs in logs

idjagger
Engager

Hi all,

I'm trying to find which programs from a given list haven't raised an event in the eventlog in the last timeperiod to create an alert based on it.

For an individual alert I have 

index=eventlogs SourceName="my program" | stats count as COUNT_HEARTBEAT | where COUNT_HEARTBEAT=0

which works.

How can I supply a list of programs and list which of them have a COUNT_HEARTBEAT of 0 so that I can make a generic alert?

 

Thanks,

 

Kind regards,

 

Ian

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

See this blog entry for a good write-up on how to do that.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

See this blog entry for a good write-up on how to do that.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.

idjagger
Engager

Thank you, that is the perfect answer.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could store them in a csv file and append that to your events then count by program name.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...