Hi
I am trying to find out how many events has been indexed in last 10 minute. I can find out total number of eventcount
for index since beginning of time by typing | eventcount index=*
but I am not able to find eventcount for last 15 minute. If there is no event count in last 15 minute then I would like to send alert to scoutapp
. When i change time on search bar for 15 minutes than i am getting same result as | eventcount index=*
with Regards,
Rakesh
If your requirement is to send alert if there are no event received on particular index from particular sources, then you can use the following search command
| metadata type=hosts index=myindex
Above command returns the list of hosts sending data to the index "myindex" and when was the last event received. If the last event received timestamp is 15 min earlier to the current time, then you can create the alert.
Hope this information is useful.
Thanks for your answer. I am really new to splunk. Can you please tell me how to