How to generate a splunk alert for missing file?

[pradeepkm]

My requirement is to generate alert if no file received within cut off time for set of files say around 50. I want o avoid creating alert for each file. Please suggest me the best approach

[richgalloway]

The answer depends on the results you want.  To just find out that a file is missing then count the files you have and alert if that number is less than what is expected.

index=foo
| stats dc(source) as fileCount
| where fileCount < 50

If, OTOH, you need to know which file is missing then you have more work to do.  Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

[pradeepkm · Accepted solution]

Thanks the solution in the blog worked.

[pradeepkm]

My use case is I have different file names and I need to alert support team if the particular file not received within cutoff