Alerting

How to generate a splunk alert for missing file?

pradeepkm
Explorer

My requirement is to generate alert if no file received within cut off time for set of files say around 50. I want o avoid creating alert for each file. Please suggest me the best approach

Labels (3)
Tags (2)
0 Karma
1 Solution

pradeepkm
Explorer

Thanks the solution in the blog worked.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The answer depends on the results you want.  To just find out that a file is missing then count the files you have and alert if that number is less than what is expected.

index=foo
| stats dc(source) as fileCount
| where fileCount < 50

If, OTOH, you need to know which file is missing then you have more work to do.  Finding something that is not there is not Splunk's strong suit.  See this blog entry for a good write-up on it.

https://www.duanewaddle.com/proving-a-negative/

---
If this reply helps you, Karma would be appreciated.

pradeepkm
Explorer

Thanks the solution in the blog worked.

0 Karma

pradeepkm
Explorer

My use case is I have different file names and I need to alert support team if the particular file not received within cutoff 

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! &#x1f44f; Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...