topic Re: Monitor Splunks Internal Processes and Log Ingestion in Splunk Enterprise

Monitor Splunks Internal Processes and Log Ingestion

celdridge1988 — Fri, 12 Jun 2020 16:36:48 GMT

Hi All,

Currently running a distributed instance of Splunk on prem. Is there a way to monitor splunk manually through search rather than the DMC? The reason is because i would like to alert teams of faults (like an indexer not being seen by a cluster master etc.). I've also had an issue where we've not noticed where a data source has stopped ingesting, has anyone been able to successfully implement a search to detect when a log source stops ingesting?

All ideas are welcome! Thank you in advance 🙂

Re: Monitor Splunks Internal Processes and Log Ingestion

richgalloway — Fri, 12 Jun 2020 18:18:45 GMT

The Monitoring Console is a search head so you can create your own alerts there, if you wish. Just search the logs for the error condition of interest and save it as an alert.

Re: Monitor Splunks Internal Processes and Log Ingestion

gjanders — Sat, 13 Jun 2020 09:31:45 GMT

Alerts for Splunk Admins might help here