topic Re: How to create an alert when CISCO IPS App is not collecting logs. in Getting Data In

How to create an alert when CISCO IPS App is not collecting logs.

integratednet — Sun, 12 Oct 2014 12:59:33 GMT

Hi Folks

Can anybody advice how to create an alert when the Splunk CISCO IPS does not poll the data from the IPS device for more than 3 days?

Best regards
Muralee

Re: How to create an alert when CISCO IPS App is not collecting logs.

esix_splunk — Sun, 12 Oct 2014 21:11:21 GMT

Quickest way would be via metadata. Check the latest time for your datasource, and if its > 3 days, you can fire and alert.

| metadata type=sourcetypes index=whereipsdatais | ......

Good luck.

Re: How to create an alert when CISCO IPS App is not collecting logs.

integratednet — Mon, 13 Oct 2014 05:04:58 GMT

Thanks for the reply.

Being a beginner I would appreciate if you could provide me the complete syntax.

Best regards
Muralee,

Re: How to create an alert when CISCO IPS App is not collecting logs.

esix_splunk — Mon, 13 Oct 2014 16:32:49 GMT

Can't write the complete search for you, but you can follow the splunk docs and can help you out a bit-

http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Metadata

Here is a base search that returns useful data, you can filter this down based on your sourcetype and host(s) of interest-

| metadata type=hosts index=_internal | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")