Alerting

How to create alerts to identify hosts that have not sent files in the last hour?

kentscott10
New Member

I am very new to splunk and have been searching for how to create alerts that identify hosts that do not send their files (might alert us to a network or system error). I have found some examples (files note sent between times, files not sent for a specific host, etc.) but i need this to run every hour and report all hosts that have not sent a file. Amy help would be appreciated.

Tags (2)
0 Karma

kentscott10
New Member

Tried your suggestion and it does send out an alert but it does not lists the hosts that met the criteria. For example, right now I have 10 hosts and it is only one that did not send any files. Is there a way for the alert to identify which host(s) in the alert?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The query does give the name of the host. Just ensure you select checkboxes to include result in the alert email. See this http://docs.splunk.com/Documentation/Splunk/7.0.1/Alert/Emailnotification#Define_an_email_notificati...

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

| metadata type=hosts index=* | table host lastTime | where lastTime<relative_time(now(),"-1h@h") | eval "Last Reported On"=strftime(lastTime,"%F %T") | fields - lastTime

Run this every hour (e.g. cron: 11 * * * *)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...