topic Alert on Data Not Sending in Alerting

Alert on Data Not Sending

PA-Lan-Tel — Mon, 22 Nov 2021 20:37:38 GMT

I would like to have an alert sent when my syslog server stops sending logs to the Splunk application. Because I am very new to Splunk can I get some examples please.

Re: Alert on Data Not Sending

bowesmana — Tue, 23 Nov 2021 02:06:33 GMT

Very simple to write a search that you can set to trigger if the results are 0

| tstats count where index=your_syslog_index earliest=-2m@m latest=-1m@m

and then in your alert make it trigger on the custom trigger condition "search count = 0"

Note that if you have periods when you would not get syslog data for a minute, then it will trigger, so

Re: Alert on Data Not Sending

PA-Lan-Tel — Tue, 23 Nov 2021 09:56:43 GMT

Thanks Karma appreciate the quick response