Dashboards & Visualizations

How to set cron expresion and time range of alert correctly if event delay in index time

bestSplunker
Contributor

hello everyone:

I have create db connect inputs, It reads record from the database every five minutes to the Splunk index.
but I found that there was a 30 minute difference between index time and event time. as follows:

index = test
|eval indextime=strftime(_indextime,"%Y/%m/%d %H:%M:%S")
|eval age=(_indextime - _time)/60
|table indextime _time age

--------------------------------------------------------------------------------------------------

indextime                                       _time                                            age
2020/02/27  11:40:00                       2020/02/27 11:11:14                                 28.76667
2020/02/27 10: 30:00                       2020/02/27 09: 59:36                                30.40000
2020/02/27 10:25: 00                       2020/02/27 09: 56: 48                               28.20000

now, I want to create an alert to query important events , I hope this alert to run every 10 minutes, so how to set the time range in alert setting correctly, prevent missing important events or repeating alert?

time range:  ???? How to set up correctly

cron expresion :  */10 * * * *
0 Karma
1 Solution

adonio
Ultra Champion

you can use the index time as your search filter:
_index_earliest=-11m@m _index_latest=-1m@m (for example) and you will never miss a bit as long as search doesn't skip
read more here
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/SearchTimeModifiers

View solution in original post

0 Karma

adonio
Ultra Champion

you can use the index time as your search filter:
_index_earliest=-11m@m _index_latest=-1m@m (for example) and you will never miss a bit as long as search doesn't skip
read more here
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/SearchTimeModifiers

0 Karma

bestSplunker
Contributor

thank you very much, so if i use index time, I can ignore time range of the alert settting, because index time in search effect takes precedence over time range?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...