Dashboards & Visualizations

How to set cron expresion and time range of alert correctly if event delay in index time

bestSplunker
Contributor

hello everyone:

I have create db connect inputs, It reads record from the database every five minutes to the Splunk index.
but I found that there was a 30 minute difference between index time and event time. as follows:

index = test
|eval indextime=strftime(_indextime,"%Y/%m/%d %H:%M:%S")
|eval age=(_indextime - _time)/60
|table indextime _time age

--------------------------------------------------------------------------------------------------

indextime                                       _time                                            age
2020/02/27  11:40:00                       2020/02/27 11:11:14                                 28.76667
2020/02/27 10: 30:00                       2020/02/27 09: 59:36                                30.40000
2020/02/27 10:25: 00                       2020/02/27 09: 56: 48                               28.20000

now, I want to create an alert to query important events , I hope this alert to run every 10 minutes, so how to set the time range in alert setting correctly, prevent missing important events or repeating alert?

time range:  ???? How to set up correctly

cron expresion :  */10 * * * *
0 Karma
1 Solution

adonio
Ultra Champion

you can use the index time as your search filter:
_index_earliest=-11m@m _index_latest=-1m@m (for example) and you will never miss a bit as long as search doesn't skip
read more here
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/SearchTimeModifiers

View solution in original post

0 Karma

adonio
Ultra Champion

you can use the index time as your search filter:
_index_earliest=-11m@m _index_latest=-1m@m (for example) and you will never miss a bit as long as search doesn't skip
read more here
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/SearchTimeModifiers

0 Karma

bestSplunker
Contributor

thank you very much, so if i use index time, I can ignore time range of the alert settting, because index time in search effect takes precedence over time range?

0 Karma
Get Updates on the Splunk Community!

Testing out the OpenTelemetry Collector With raw Data

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...