https://community.splunk.com/t5/Getting-Data-In/Monitor-syslog-Inputs/m-p/246609#M47600 <P>I currently have a syslog server forwarding data to our splunk instance. I wanted to know if there were any searches that i could run to make sure these data sets coming in via syslog are always working. I have a search that runs for my windows boxes which checks the forwarders and that i'm not missing data from them. I was wondering if this was possible with my servers that are sending via syslog.</P> <P>-Thank you</P> Mon, 25 Jan 2016 15:59:10 GMT JScordo 2016-01-25T15:59:10Z https://community.splunk.com/t5/Getting-Data-In/Monitor-syslog-Inputs/m-p/246609#M47600 <P>I currently have a syslog server forwarding data to our splunk instance. I wanted to know if there were any searches that i could run to make sure these data sets coming in via syslog are always working. I have a search that runs for my windows boxes which checks the forwarders and that i'm not missing data from them. I was wondering if this was possible with my servers that are sending via syslog.</P> <P>-Thank you</P> Mon, 25 Jan 2016 15:59:10 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-syslog-Inputs/m-p/246609#M47600 JScordo 2016-01-25T15:59:10Z https://community.splunk.com/t5/Getting-Data-In/Monitor-syslog-Inputs/m-p/246610#M47601 <P>If you know the source names that you expect to see from the syslog server, you can easily use a metadata search and see what the lastTime value was for each source name. I like to use a regex filter to find only certain file names and then some time interval to wait.</P> <P>| metadata type=sources index=* | regex source="" | eval lt=now() - lastTime | where lt&gt;300</P> <P>Schedule this to run on a 5 minute (or whatever) interval you need to check.</P> Mon, 25 Jan 2016 17:15:44 GMT https://community.splunk.com/t5/Getting-Data-In/Monitor-syslog-Inputs/m-p/246610#M47601 sjohnson_splunk 2016-01-25T17:15:44Z