topic Alerting on missing data in Alerting

Alerting on missing data

Crashfry — Thu, 28 Feb 2019 02:41:16 GMT

Looking to see what others do for missing data - an example being a universal forwarder on a linux server, stops sending logs from bash history for root.. assuming it's a source type - what are others doing to make sure an alert is triggered when a situation similar happens? Any help would be great!

Re: Alerting on missing data

pkeenan87 — Thu, 28 Feb 2019 16:44:45 GMT

I am a big fan of the meta woot app. You can repurpose some of the dashboard searches into alerts: https://splunkbase.splunk.com/app/2949/#/details

Re: Alerting on missing data

lakshman239 — Thu, 28 Feb 2019 17:04:00 GMT

You can have a list of sourcetypes which you want to monitor in a lookup along with max allowed delay time and using metadata, you can monitor them.
https://answers.splunk.com/answers/730503/query-to-see-the-forwarder-does-not-send-logs.html#answer-729766