https://community.splunk.com/t5/Alerting/How-to-create-alert-for-server-forwarder-index-that-doesn-t-work/m-p/444675#M7805 <P>Ok thanks but here's another question:</P> <P>Any way I can make these alerts pop on the search heads too? Currently it's only a triggered alert on the indexer master node.</P> Mon, 16 Jul 2018 08:34:44 GMT agentsofshield 2018-07-16T08:34:44Z https://community.splunk.com/t5/Alerting/How-to-create-alert-for-server-forwarder-index-that-doesn-t-work/m-p/444673#M7803 <P>In order to find out more quickly if a certain part of Splunk doesn't work, I figured that maybe there's a way to create an alert in case one of these things doesn't work?:</P> <UL> <LI>Server (if any server is down - search, indexer, deployment, etc.)</LI> <LI>Forwarder</LI> <LI>Index (I'd like to check on important indexes we use all the time)</LI> </UL> <P>I want an alert in case one of these doesn't work. Anyone knows how?</P> <P>Cheers</P> Mon, 16 Jul 2018 06:54:49 GMT https://community.splunk.com/t5/Alerting/How-to-create-alert-for-server-forwarder-index-that-doesn-t-work/m-p/444673#M7803 agentsofshield 2018-07-16T06:54:49Z https://community.splunk.com/t5/Alerting/How-to-create-alert-for-server-forwarder-index-that-doesn-t-work/m-p/444674#M7804 <P>Hi @agentsofshield ,</P> <P>You could use monitoring console (Old DMC)for that. Please have a look at this <A href="http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Platformalerts">http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Platformalerts</A><BR /> AND<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Configureforwardermonitoring">http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Configureforwardermonitoring</A><BR /> AND<BR /> In general : <A href="http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Monitoringoverview">http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/Monitoringoverview</A></P> <P>Please lets know in case you need further help</P> Mon, 16 Jul 2018 07:52:59 GMT https://community.splunk.com/t5/Alerting/How-to-create-alert-for-server-forwarder-index-that-doesn-t-work/m-p/444674#M7804 renjith_nair 2018-07-16T07:52:59Z https://community.splunk.com/t5/Alerting/How-to-create-alert-for-server-forwarder-index-that-doesn-t-work/m-p/444675#M7805 <P>Ok thanks but here's another question:</P> <P>Any way I can make these alerts pop on the search heads too? Currently it's only a triggered alert on the indexer master node.</P> Mon, 16 Jul 2018 08:34:44 GMT https://community.splunk.com/t5/Alerting/How-to-create-alert-for-server-forwarder-index-that-doesn-t-work/m-p/444675#M7805 agentsofshield 2018-07-16T08:34:44Z https://community.splunk.com/t5/Alerting/How-to-create-alert-for-server-forwarder-index-that-doesn-t-work/m-p/444676#M7806 <P><A href="http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/WheretohostDMC">http://docs.splunk.com/Documentation/Splunk/7.1.2/DMC/WheretohostDMC</A></P> Mon, 16 Jul 2018 08:41:53 GMT https://community.splunk.com/t5/Alerting/How-to-create-alert-for-server-forwarder-index-that-doesn-t-work/m-p/444676#M7806 renjith_nair 2018-07-16T08:41:53Z https://community.splunk.com/t5/Alerting/How-to-create-alert-for-server-forwarder-index-that-doesn-t-work/m-p/444677#M7807 <P>Ok, what about indexes? Can I check if an index brings back results and if it doesn't, create an alert?</P> Mon, 16 Jul 2018 10:58:38 GMT https://community.splunk.com/t5/Alerting/How-to-create-alert-for-server-forwarder-index-that-doesn-t-work/m-p/444677#M7807 agentsofshield 2018-07-16T10:58:38Z