https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-stops-working-have-to-trigger-email/m-p/442125#M77063 <P>This alert is consolidated.so i have to show index in the table </P> Tue, 31 Jul 2018 07:18:13 GMT karthi2809 2018-07-31T07:18:13Z https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-stops-working-have-to-trigger-email/m-p/442123#M77061 <P>One of my splunkforwarder is down last month .I am trying to find when the host is stop working .have to trigger alert when host is down.now i am using query that will check only 30 min .Can any one help on this.Thanks in advance</P> <P>My query :<BR /> | metadata type=hosts index=XXX | eval age = now() - recentTime | eval status= case(age &lt; 1800,"Running",age &gt; 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn<BR /> | eval age=tostring(age,"duration") | eval host = upper(host)<BR /> | table host age LastActiveOn status <BR /> | rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status| where Status= "DOWN"</P> Wed, 18 Jul 2018 05:22:37 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-stops-working-have-to-trigger-email/m-p/442123#M77061 karthi2809 2018-07-18T05:22:37Z https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-stops-working-have-to-trigger-email/m-p/442124#M77062 <P>Hi @karthi2809,</P> <P>This alert should work if all of your hosts are sending data at least every 30 minutes ( normally forwarders send data continuously at least for the _internal data). The difference is only in the "time range" you select to run this search. If you require to check hosts which are down for more than a month, then the time range also should be selected accordingly. However, once the alert is implemented, if any hosts goes down,then it should be notified there after.</P> Wed, 18 Jul 2018 14:58:58 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-stops-working-have-to-trigger-email/m-p/442124#M77062 renjith_nair 2018-07-18T14:58:58Z https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-stops-working-have-to-trigger-email/m-p/442125#M77063 <P>This alert is consolidated.so i have to show index in the table </P> Tue, 31 Jul 2018 07:18:13 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-forwarder-stops-working-have-to-trigger-email/m-p/442125#M77063 karthi2809 2018-07-31T07:18:13Z