I need to monitor for unscheduled downtime while avoiding scheduled downtime that happens at unequal hour boundary.
Detecting downtime is easy (look for no heartbeat events in last 60s). Setting crontab to start running the searches on equal hour boundary (say, 01:00) is easy. However, it seems to be impossible to set crontab to start at unequal hour boundary (say, 00:40).
Is there another way to implement such search?
asked 12 Jul '11, 16:24
I'm not sure I understand you question, but a crontab entry of:
will run every hour at 40 minutes past the hour, but I don't know what you mean when you say you want to run every minute, but also only at 40 minutes pas an hour.
answered 12 Jul '11, 21:33
I don't think you can do this only using cron. I assume you are using this for an alert so, the way I would approach it is to run every minute between midnight and 3am.
Then use the custom condition and where command to limit the time. Assuming you were looking for zero events...
so my savedsearch looks like this
[edit ref comment]
Oops! Sorry not thinking straight there. Adding the following to your search will do what you want
This is the very, very low tech way of handling this - and it does not scale well - but you could always have multiple copies of the same scheduled search/alert.
It looks like it would take three cron entries:
Note I'm assuming that Splunk's crontab is as flexible as Vixie cron - which it should be.
answered 13 Jul '11, 19:06