Hi I was wondering if it is possible on splunk to search for a specific message on a source/log then alert if the last event received was more than 2 minute ago
my search string is:
index=[index] host=[host] sourcetype=[sourcetype] "Keyword"
I'm searching for the word "Keyword" and i want to set an alert if the last result is more than 2 minutes ago
Thanks in advance
How about narrowing your search to the last 2 minutes and setting an alert if there are no results?
Hi @richgalloway thanks for your response,
I tried narrowing it to 2 minutes by adding 'earliest=-2m latest=now()' to my search, i have set it to run every 1 minute and if the result is 0 the alert should trigger, but sometimes the alert is triggering even if the results is > 0, is this a problem on timing?
note: the keyword is generated every 1 minute