topic Re: Send email when application server/network device is not pushing syslog to Splunk in Getting Data In

Send email when application server/network device is not pushing syslog to Splunk

satoshi86 — Tue, 09 Oct 2012 03:28:52 GMT

Hi All,

Is there a way for Splunk to send out an email notification when Splunk is not receiving any syslog entries from an application server or a network device?

Thanks.

Re: Send email when application server/network device is not pushing syslog to Splunk

lguinn2 — Tue, 09 Oct 2012 04:34:56 GMT

Yes, although you need to define some criteria. For example -

Search for hosts that have sent syslog events in the past week, but have not sent syslog events in the past hour.

Here is a search that would work:

sourcetype=*syslog* earliest=-7d 
| fields host 
| eval hcount = if (_time>=relative_time(now(),"-1h"),1,0)
| stats sum(hcount) as hourlyCount count as weeklyCount by host
| where hourlyCount == 0

You could then schedule this to run every hour and alert if number of events is greater than zero.

Re: Send email when application server/network device is not pushing syslog to Splunk

satoshi86 — Wed, 10 Oct 2012 07:16:57 GMT

Hi Iguinn,
I tried to run your command and it gives me the error:-

Error in 'eval' command: The arguments to the 'relative_time' function are invalid.

May I know how do i fix that?
I'm very sorry, I'm kinda weak in programming.

Re: Send email when application server/network device is not pushing syslog to Splunk

lguinn2 — Wed, 10 Oct 2012 20:19:43 GMT

Sorry, it's a typo. I've updated my original answer to fix it! Thanks for commenting and sorry about that.

Re: Send email when application server/network device is not pushing syslog to Splunk

satoshi86 — Fri, 19 Oct 2012 10:14:05 GMT

thanks again for your help Iguinn!!