topic Re: Stop sending in Getting Data In

Stop sending

aalhabbash1 — Sat, 25 May 2019 18:34:39 GMT

Hi Splunker;

How to detected a index stop receiving logs from any technology last 2 hours, I need for indexes not sourcetype?

Appreciate your support.

Best Regards;

koshyk — Sat, 25 May 2019 20:44:12 GMT

the best way is to see when the last time you got the data into the index and see if that time is > 2 hours

|tstats latest(_time) as latest_event WHERE (index=* OR index=_*) by index
|eval timeDiff=now() - latest_event
| where timeDiff > 7200

it should show any index which has not recieved data in last 7200 secs (i.e 2hrs)

aalhabbash1 — Sun, 26 May 2019 07:49:15 GMT

Mr.Koshyk

Done; many thank you, this is which I want, appreciate that

Best Regards;