CODEWITHSUNDEEP
splunk
ajjain
ajjain

Reputation: 1169

Time based sliding window query in splunk

Is there a way to do time based sliding window query in splunk on real time? To provide an insight what I am looking for is, lets say if log statements are published to splunk, can I get counts of error which has occurred in last 15 minutes. And this has to be sliding and continuously updating me the state of the system.

Upvotes: 0

Views: 777

Answers (1)

mihai.ciorobea
mihai.ciorobea

Reputation: 741

As you said, you can use real time queries.

  1. create your query
  2. make it real time (last 15 min)
  3. save as alert
  4. set the cron period for the query to run

Hope it helps.

Upvotes: 1

Related Questions