hai Thanks for your reply. i have tested for alert using this search but  the data is updating into splunk from source for every 5 mins  and status was in offline when lastupdated="2023-08-24 12:51:49.62"  and status was changed IDLE  lastupdated="2023-08-24 13:00:01.637"   how to modify the search if status was offline for 2 polls when collecting data  for example event time 8/24/23 6:25:00.873 PM  data collection it was in offline and also next interval 2023-08-24 08:00:02.202 if it was offline , need to get  below are the events while testing for one  8/24/23 6:45:00.920 PM 2023-08-24 08:15:00.920, BOT_Name="HOUVMITBPRSMX21:8001", lastupdated="2023-08-24 13:14:57.803", BOT_Status="Working" host = TEST BP_Botstatus_Newquery sourcetype = testsoucetype 8/24/23 6:40:01.652 PM 2023-08-24 08:10:01.652, BOT_Name="HOUVMITBPRSMX21:8001", lastupdated="2023-08-24 13:10:00.85", BOT_Status="Working" host = TEST source = testcource sourcetype = testsoucetype 8/24/23 6:35:00.968 PM 2023-08-24 08:05:00.968, BOT_Name="HOUVMITBPRSMX21:8001", lastupdated="2023-08-24 13:04:59.833", BOT_Status="Working" host = TEST source = BP_Botstatus_Newquerysourcetype = testsoucetype 8/24/23 6:30:02.202 PM 2023-08-24 08:00:02.202, BOT_Name="HOUVMITBPRSMX21:8001", lastupdated="2023-08-24 13:00:01.637", BOT_Status="Idle" host = TEST source = testcourcesourcetype =testsoucetype 8/24/23 6:25:00.873 PM 2023-08-24 07:55:00.873, BOT_Name="HOUVMITBPRSMX21:8001", lastupdated="2023-08-24 12:51:49.62", BOT_Status="Offline" host = TEST source = testcourcesourcetype =testsoucetype ... View more

BUT THIS SEARCH YOU SAID TO RUN FOR EVERY 15 MINS TO GET IF OFFLINE MORE THAN 10 MINS  SO FOR SCHEDULING ALERT WHAT TIME RANGE CAN I GIVE TO CHECK THE DATA AND CRON SCHEDULE  index=Testindex sourcetype="Bueprism" source=Botstatus | stats latest(BOT_Status) as BOT_Status latest(lastupdated) as lastupdated by BOT_Name | where BOT_Status="Offline" AND strptime(lastupdated,"%Y-%m-%d %H:%M:%S") < relative_time(now(), "-10m")   ... View more

hai what was the cron interval can i keep for alert schedule to get expected  ... View more

this is working, what was cron interval can i keep to get alerts as expected  can i run it for every 15 mins  ... View more

this is working, what was cron interval can i keep to get alerts as expected  can i run it for every 15 mins    and  @gcusello also provided the same query but not giving any results not sure why    ndex=Testindex sourcetype="Bueprism" source=Botstatus BOT_Status="Offline" | stats earliest(lastupdated) AS earliest latest(lastupdated) AS latest latest(_time) AS _time BY BOT_Name | eval latest=if(isnull(latest),_time,latest) | where latest-earliest>300     ... View more

for below REST Api SEARCH how can i configure the script in the inputs.conf files | rest /services/apps/local | search disabled=0 AND version!=1.0.0 AND check_for_updates = 1 AND update.version!=null | rename update.version AS New_version | table label title author version update.name New_version version update.homepage description docs_section_override ... View more

can you tell me the configuration for this. is it by using HEC token    ... View more

i want to collect the data about App installed in all of my HF"S into splunk cloud . i have a splunk search to get the data but how can i send this OUTPUT to splunk cloud as we have on-prem HF"S | rest /services/apps/local | search disabled=0 AND version!=1.0.0 AND check_for_updates = 1 AND update.version!=null | rename update.version AS New_version | table label title author version update.name New_version version update.homepage description docs_section_override     ... View more

Hai, Thanks for your response. can we get those data into splunk search which is splunk cloud i am using for the Apps information in HF"S   ... View more

we are getting this data using DB connect from postgre db using below query and has 2 fields  report_json AND I have modified the query to to convert json object.   ... View more

the search gives me for running but not getting how to get for if process not running ... View more

Not giving results one job exceeded cutoff time for below we have event in splunk for job_name Test job HAS  START_TIME  at 2023/06/15 23:30:33 and  END_TIME 2023/06/16 00:04:09  cutoff time is 23:40 but when i was searching its not showing this,its not taking due to day change with END_TIME how can i overcome this to check if any exceeded on the day even it was changed the day ... View more

hai, i have added props.conf file in Heavy forwarders but getting duplicate events for one log which is as CST and UTC check below  please let me know anything need to add. ... View more

what was the configuration based on my  sourcetype = netapp:cloudsecure:agentlog  i have already added props file as mentioned in eariler is anything need to add  transform config file also required here.     ... View more

we have multiple HF"S. do we need to add props file for this in all of those HF ? and also how we can add is it by creating new app in the HF  ... View more

i have added props.conf in the Deployment server for the specific app to update in the UF  ... View more

i have already added props file with sourcetype but didnt fixed.   [netapp:cloudsecure:agentlog] TZ = UTC ... View more