topic Re: How to set alert when database inputs is not working? in Alerting

How to set alert when database inputs is not working?

karthi2809 — Tue, 14 Mar 2017 03:47:07 GMT

In database inputs i created one data inputs and set query and rising coloumn as time and i am getting result from database .some times the data inputs is not working .so how to set manual alert when data inputs is not working

Re: How to set alert when database inputs is not working?

adonio — Fri, 24 Mar 2017 02:24:07 GMT

do you see any errors in index = _internal when the input is not working?
some fast and dirty way to alert on it is just run the search index = | stats count | bin span= _time
set an alert if count = 0

Re: How to set alert when database inputs is not working?

mattymo — Tue, 29 Sep 2020 13:23:28 GMT

Check out the dbx health > Input metrics dashboard in DBX3.

http://docs.splunk.com/Documentation/DBX/3.0.2/DeployDBX/Monitordatabaseconnectionhealth

This one is very useful >> index=_internal sourcetype = dbx_job_metrics | table connection, name, record_read_success_count, status, start_time, end_time, duration

if you are using an older version, see appropriate docs, but the idea would be the same.https://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Troubleshooting

Regardless of the version, check the _internal sourcetype for appropriate logging to determine all is well, then use something like meta woot which has this beauty tstats search | tstats count min(_time) as firstTime, max(_time) as lastTime, max(_indextime) as recentTime where _index_earliest=-10m@m _index_latest=-5m@m by host, sourcetype, index | eval host=lower(host) | eval _time=now()-300 to check for event trend and alert on no/low events counts or, to calculate last indexed event time compared to now...and if that time creeps too long...alert...

https://splunkbase.splunk.com/app/2949/

Once you get the search that gives you the indicator you trust, save it as an alert:

https://docs.splunk.com/Documentation/Splunk/6.5.2/Alert/Aboutalerts

Re: How to set alert when database inputs is not working?

somesoni2 — Fri, 24 Mar 2017 04:05:30 GMT

If you're indexing your dbx logs (dbx.log for DB Connect v1, dbx2.log for DB Connect v2, not sure about v3), you should be able to find logs pertaining to your data input (definition loaded, execution started/finished events). Based on frequency of your input and average execution time, you can setup appropriate alert when you don't see a finished event.