Alerting

Alert on file age

diegosainz
Path Finder

I would like to know if it is possible to be alerted if a file is older then a specific time frame. We have files that are written down every 5 minutes. I would like to be alerted if the age of the file is in excess of 7 minutes.

Any input would be appreciated.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try following:

|metadata type=sources index=* | eval age=now()-recentTime | where age>420

This lists all the sources (files indexed in Splunk) which were last accessed 420 sec (7 min) ago. You can setup alert when this search returns rows.

0 Karma

aholzer
Motivator

You probably want something that checks _time vs _indexedtime.

... | eval diff = _indexedtime - _time | where diff > 5*60*1000

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...