Alerting

Setup alert on inactivity

dhirajjain
New Member

Hi,

I want to setup an alert in SPLUNK where it gives me an alarm when there is no log for 15 mins.

Please guide me

Thanks
DJ

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

First, you should take a look at http://docs.splunk.com/Documentation/Splunk/5.0.3/Alert/Aboutalerts

After that, define a search that looks for your logs - maybe something like this:

index=foo sourcetype=bar field=baz | stats count

Create an alert for that, scheduled to run every fifteen minutes over a fifteen minute timerange, triggered if count is zero. If you're confident to have delays less than five minutes your timerange could be -5m to -20m, and your cron schedule could be */15 * * * *.

carfield
New Member

Can I search for multiple log files, and group by each file, then alert if either one of the files don't update?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...