Alerting

Alert needs to be configured if there is no logs for an index

anandhalagaras1
Path Finder

Hi Team,

I want to schedule an alert something like there is no event for a particular index for more than 15 minutes it should trigger an email notification to our team.

For example: Index= os

So kindly help with the query is setting up the same.

 

Labels (1)
0 Karma
1 Solution

gcusello
Legend

Hi @anandhalagaras1,

you should schedule an alert, tu run every 15 minutes, running a search like this:

index=os earliest=-15m@m latest=now

that has as activation condition results=0ans as action send email.

In other words:

  • run the above search,
  • click on "Save as Alert",
  • insert the informations requested:
    • cron */15 * * * *
    • activation for results=0
    • action=send eMail.

Ciao.

Giuseppe

View solution in original post

gcusello
Legend

Hi @anandhalagaras1,

you should schedule an alert, tu run every 15 minutes, running a search like this:

index=os earliest=-15m@m latest=now

that has as activation condition results=0ans as action send email.

In other words:

  • run the above search,
  • click on "Save as Alert",
  • insert the informations requested:
    • cron */15 * * * *
    • activation for results=0
    • action=send eMail.

Ciao.

Giuseppe

gcusello
Legend

Hi @anandhalagaras1,

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...