Hello, I've a simple requirement but new to Splunk so facing some challenges and hoping for some luck! My application writes HEARTBEAT messages every 2 min to log files to multiple sources. I'm just trying to create an alert and send email if heartbeat messages aren't written in last 5 min. It may look simple but I also need to know which sources doesn't have heartbeat messages. I've tried with below query which works but sometimes giving me incorrect results. So, looking for an better and simple solution. index = index1 earliest=-5m latest=now source IN (dev-*api.log) ("testapi" AND "HEARTBEAT")
| fields source
| append [ search index = index1 earliest=-2w@w0 latest=now source IN (dev-*api.log) ("testapi" AND "HEARTBEAT")
| stats dc(source) as source_list by source
| fields source
]
| rex field=_raw "HEARTBEAT for (?<APIName>.*).jar (?<Version>.*)"
| stats count as #heartbeats, latest(Version) as Versions by APIName, JVM
| eval Status=case(('#heartbeats' <= 1 OR isnull('#heartbeats')), "NOT RUNNING", '#heartbeats' > 1, "RUNNING")
| table APIName, Versions, Status Appreciate the help! Thanks.
... View more
