topic Re: Log sources not reporting in Monitoring Splunk

Log sources not reporting

sahildb — Mon, 08 Feb 2021 04:34:56 GMT

Currently our index= windows host not reporting from last couple of days.

Need query to set up alert if log sources are not reporting to splunk.

sahildb — Mon, 08 Feb 2021 04:54:30 GMT

Need to verify and set up alert which index generate data and or not and how we can monitor

scelikok — Mon, 08 Feb 2021 05:48:13 GMT

You can use Broken Hosts app to monitor your data ingestion problems,

sahildb — Mon, 08 Feb 2021 06:35:31 GMT

Thanks for the solution i think will recommend the same to team.

sahildb — Mon, 08 Feb 2021 07:38:47 GMT

Is there any query we can use to detect ?

scelikok — Mon, 08 Feb 2021 09:38:11 GMT

You can use below query to find hosts that is not reporting for 60 minutes by host, index and sourcetype.

| tstats max(_time) as _time where index=* by index host sourcetype | where _time < relative_time(now(),"-60m")

You can adapt 60 minutes timeout and indexes to your need.