- Splunk Answers
- :
- Using Splunk
- :
- Alerting
- :
- Monitor and generate alert if no changes are made ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A monitored file changes very frequently. If no new change occurs during a specified interval, it means that the process which makes changes to the log file is down. This can be used to monitor if the process is alive. How can I monitor and generate alert on an event "no changes made to monitored file during nnn minutes"?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @mdzmuran,
When you say "no changes made", does that mean no events are being indexed into Splunk?
How about you count the number of indexed events for your particular log file for the last 15 minutes:
index=YOURINDEX source=YOURFILE | stats count
If the count is 0 then I assume the process is down. Save this search as an alert with the custom trigger condition "search count = 0"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @mdzmuran,
When you say "no changes made", does that mean no events are being indexed into Splunk?
How about you count the number of indexed events for your particular log file for the last 15 minutes:
index=YOURINDEX source=YOURFILE | stats count
If the count is 0 then I assume the process is down. Save this search as an alert with the custom trigger condition "search count = 0"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Which operating system are you using?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The monitored files are on a UNIX machine. The directories are accessible from a Windows machine with Splunk Forwarder (UNC is used in Spunk directory definition). Splunk Forwarder monitores these files, it is working now and communicating with Splunk Free (at this moment). So monitoring files works, I can check for errors, generate alerts on errors, etc. And I want to check an event "nothing happens to the files".
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
Splunk APM: New Product Features + Community Office Hours Recap!
Index This | Forward, I’m heavy; backward, I’m not. What am I?
