topic Re: Silent Log Source in Monitoring Splunk

Silent Log Source

Sultan77 — Mon, 17 Feb 2025 12:38:35 GMT

Good day everyone.

I am trying to monitor the environment hosts whether if any stopped sending logs.

The challenge here to make through content management > correlation search.

So it can be scheduled every ex: 2 hours.

any idea?

Re: Silent Log Source

ITWhisperer — Mon, 17 Feb 2025 12:53:58 GMT

Splunk is not good at finding things which aren't there - normally you need to give it a list of what to expect and then check to see which of those are there. For example, you could create a list of hosts that are normally sending events to Splunk and count the events from those hosts over a period of time. Any hosts which don't have events may have stopped sending events.

Re: Silent Log Source

gcusello — Mon, 17 Feb 2025 12:57:35 GMT

Hi @Sultan77 ,

you have two choices:

create a lookup (called e.g. perimeter.csv and containing at list only one field: "host") containing the list of hosts to monitor and run a search like the following:

otherwise, if you don't want to create and manage the lookup, you could check if an host sent logs e.g. in the last 30 days but not in the last 2 hours:

| tstats count latest(_time) AS _time where index=* earliest=-30d latest=now BY host | where _time<(now()-7200

the second search requires less maintenance but gives you less control.

Ciao.

Giuseppe

Re: Silent Log Source

Sultan77 — Mon, 17 Feb 2025 14:10:32 GMT

looks nice, but how to do the correlation with it?

Re: Silent Log Source

gcusello — Tue, 18 Feb 2025 15:14:17 GMT

Hi @Sultan77 ,

sorry, what do you mean with correlation with it?

Ciao.

Giuseppe