Hello, please help create a search add another condition to fire this alert if there are no results
Here is the splunk output if there is no result
localhost.localdomain: timed out, nothing received
index=timevariance | multikv | where isint(when) | rex field=remote "(?*\w*)" | eval abs_offset=abs(offset) | search abs_offset>=100000 | append [ search index=_* ERROR sourcetype=splunkd component=ExecProcessor NOT admon message="ntp" | stats count values(message) as _raw by host ] | eval alert_contact=case(host LIKE "irprinfspl%", "Security", host LIKE "deprinfspl%", "Security", host LIKE "%", "SysEng") | eval alert_description="Time Out of Sync. Use NOC portal to sync up time & restart ntp service. Any other issues contact alert_contact." | table _time, host, alert_contact, alert_description, _raw | search host!=splnod host!="pvtemplate"
@dave0970,
Are you looking for something similar?
index=timevariance | multikv | where isint(when) | rex field=remote "(?*\w)" | eval abs_offset=abs(offset) | search abs_offset>=100000 | append [ search index=_* ERROR sourcetype=splunkd component=ExecProcessor NOT admon message="ntp" | stats count values(message) as _raw by host ] | eval alert_contact=case(host LIKE "irprinfspl%", "Security", host LIKE "deprinfspl%", "Security", host LIKE "%", "SysEng") | eval alert_description="Time Out of Sync. Use NOC portal to sync up time & restart ntp service. Any other issues contact alert_contact." | table _time, host, alert_contact, alert_description, _raw | search (host!=splnod AND
host!="pvtemplate") OR ("nothing received")
@dave0970,
Are you looking for something similar?
index=timevariance | multikv | where isint(when) | rex field=remote "(?*\w)" | eval abs_offset=abs(offset) | search abs_offset>=100000 | append [ search index=_* ERROR sourcetype=splunkd component=ExecProcessor NOT admon message="ntp" | stats count values(message) as _raw by host ] | eval alert_contact=case(host LIKE "irprinfspl%", "Security", host LIKE "deprinfspl%", "Security", host LIKE "%", "SysEng") | eval alert_description="Time Out of Sync. Use NOC portal to sync up time & restart ntp service. Any other issues contact alert_contact." | table _time, host, alert_contact, alert_description, _raw | search (host!=splnod AND
host!="pvtemplate") OR ("nothing received")
Hi Renjith,
Thank you! I will test it out. Thanks