×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
syedikramulla
Explorer
Member since: ‎01-17-2022
‎01-20-2022
Community Statistics
Posts 5
Solutions 0
Karma Given 1
Karma Received 1
Member Since ‎01-17-2022
Activity Feed
View All

Re: How to alert only when a file exists

by in Alerting
‎01-19-2022 06:20 PM
‎01-19-2022 06:20 PM
Hi Lowell, I have a slightly different requirement.  My application will generate log file every week day in the format App_YYYYMMDD.log.  I want to write a query  to monitor the log file creation every week day and create an alert when the log file is not generated.   I also want the query to wait for some time, let's say 8 hours from the start of the day (12 AM), before generating an alert. Can you please share query for the same.   Regards, Syed ... View more

Re: How to search a log file in a path

by in Alerting
‎01-19-2022 07:58 AM
‎01-19-2022 07:58 AM
Yes I am ingesting the log file contents and have a query to generate an alert if there's an error message in the log file.  Not sure if file name is also ingested.  Let me check that. ... View more

How to search a log file in a path

by in Alerting
‎01-19-2022 07:35 AM
‎01-19-2022 07:35 AM
Hello, My application will generate a daily log file with the file name App_YYYYMMDD.log.  Example App_20220118.log, App_20220119.log.   I am trying to write a query which should return a table with single column having value as '0',  if the file for current week day is not generated.  The query should also have an condition to  wait for certain time before returning '0'. For example, let's say query should wait for 8 hours from the start of the day (12 AM) before returning the result.  Can you please share if you have written similar query.   Regards, Syed ... View more
Labels

Re: Display table base on the if condition

by in Splunk Search
‎01-19-2022 07:10 AM
1 Karma
‎01-19-2022 07:10 AM
1 Karma
thank you ... View more

Display table base on the if condition

by in Splunk Search
‎01-17-2022 07:26 AM
‎01-17-2022 07:26 AM
Hi, I want to count the LOGLEVEL only for weekdays.  If there's not logs then the query should return '0'.  Can you please help me to correct this query. index="XYZ" sourcetype=Logs LOGLEVEL=ERROR OR LOGLEVEL=FATAL OR LOGLEVEL=INFO|eval Day=strftime(_time,"%w")| eval DayType=if((Day >=0) AND (Day <=6) ,"WeeekDay","WeekEnd") | If(DayType=="WeekDay", count(LOGLEVEL=ERROR OR LOGLEVEL=FATAL OR LOGLEVEL=INFO),'0')   Regards, Syed ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎01-20-2022 04:36 AM
Karma from
View All
Karma given to
View All