Alerting

Alert needs to be configured if there is no logs for an index

anandhalagaras1
Communicator

Hi Team,

I want to schedule an alert something like there is no event for a particular index for more than 15 minutes it should trigger an email notification to our team.

For example: Index= os

So kindly help with the query is setting up the same.

 

Labels (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @anandhalagaras1,

you should schedule an alert, tu run every 15 minutes, running a search like this:

index=os earliest=-15m@m latest=now

that has as activation condition results=0ans as action send email.

In other words:

  • run the above search,
  • click on "Save as Alert",
  • insert the informations requested:
    • cron */15 * * * *
    • activation for results=0
    • action=send eMail.

Ciao.

Giuseppe

View solution in original post

gcusello
Esteemed Legend

Hi @anandhalagaras1,

you should schedule an alert, tu run every 15 minutes, running a search like this:

index=os earliest=-15m@m latest=now

that has as activation condition results=0ans as action send email.

In other words:

  • run the above search,
  • click on "Save as Alert",
  • insert the informations requested:
    • cron */15 * * * *
    • activation for results=0
    • action=send eMail.

Ciao.

Giuseppe

gcusello
Esteemed Legend

Hi @anandhalagaras1,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...