About rahul_n

richgalloway · ‎10-13-2021

That is a valid approach. However, by looking back 5 minutes every minute you run the risk of seeing (and alerting on) the same event 5 times. If you're concerned about delays in events getting indexed then give them time to do so. index=testIndex sourcetype=testSourceType basicQuery earliest=-2m latest=-1m ... The difference between setting time in the dropdown and setting it in the query is the query overrides the dropdown.

elizabethl_splu · ‎08-25-2021

Oops sorry @isoutamo , I meant to tag @rahul_n , the original poster of the message!

rahul_n · ‎05-15-2021

Thanks @renjith_nair for the solution.

rahul_n · ‎05-09-2021

Thanks @tscroggins for the solution.

rahul_n · ‎04-29-2021

@ITWhisperer , Thank you

Posts	10
Solutions	0
Karma Given	7
Karma Received	0
Member Since	‎04-23-2021

Online Status	Offline
Date Last Visited	‎10-13-2021 03:58 PM

How to set up alerts which search for every minute...

How to Schedule a PDF Delivery in Splunk ? The opt...

How to unset a token in drilldown based on specifi...

How to get the max of p90 over a month ?

How to set up alerts when current week data is mor...

Re: How to set up alerts which search for every mi...

Re: How to Schedule a PDF Delivery in Splunk ? The...

Re: How to unset a token in drilldown based on spe...

Re: How to get the max of p90 over a month ?

Re: How to set up alerts when current week data is...