topic How do you detect when a host stops sending logs to Splunk? in Alerting

How do you detect when a host stops sending logs to Splunk?

test_qweqwe — Tue, 29 Sep 2020 16:46:57 GMT

I created correlation search by this guide:
https://www.splunk.com/en_us/solutions/solution-areas/security-and-fraud/use-cases/detect-when-critical-system-stops-sending-logs.html

So, I tested it by lookup critical_systems where was working machines and machines that not sending logs near 2-3 days.
Was success trigger. But after a while the critical machine stopped sending logs - the correlation search did not work.

What can be problem?

Re: How do you detect when a host stops sending logs to Splunk?

HiroshiSatoh — Tue, 14 Nov 2017 01:33:23 GMT

The fact that it was not detected means that the log was being sent.

How about adding conditions to target only the necessary logs?

ex.
| metadata type=hosts index=your_index

Re: How do you detect when a host stops sending logs to Splunk?

gcusello — Tue, 14 Nov 2017 08:05:45 GMT

Hi test_qweqwe,
why you don't use a different search:

| metasearch index=your_index
| eval host=upper(host)
| stats count by host
| append [ | inputlookup critical_systems | eval host=upper(Host_name), count=0 | fields host count ]
| stats sum(count) AS Total BY host
| where Total=0

So hosts where Total>0 are OK hosts where Total=0 are missed.

Bye.
Giuseppe