Splunk Search

splunk - create alert for a specific host not sending data in last 30 min using metadata

New Member

Below is the search that i have prepared to check for the host named nmshost01 not sending data for over 30 min

| metadata type=hosts index=* | search host="nmshost01"| eval age = now()-lastTime | where age > (1800)| sort age d | convert ctime(lastTime) |fields host,age

This search yields appropriate results. I am unable send any alert using this as events show 0 while statistics show the result.

What is the right option to select when we save as alert. The options i get in the drop down are :
1. per results
2. number of results
3. number of hosts
4. number of sources
5. custom

I have tried number of results but i don't get any alert triggered as events show 0 in metadata search

0 Karma

Builder

Your query will return a result only when the host hasn't reported in last 30mins -

| metadata type=hosts index=* | search host="nmshost01"| eval age = now()-lastTime | where age > 1800 | sort age d | convert ctime(lastTime) |fields host age lastTime 

Hence the condition selected should be "number of events" greater than 0.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!