https://community.splunk.com/t5/Alerting/Alert-when-service-stopped-using-perf-mon/m-p/57506#M792 <P>source="Perfmon*" counter="% Processor Time" | chart last(Value) by _time, host</P> <P>How can I develop this search into an alert, which detects when a host has stopped sending perfmon events. </P> <P>I would like it to send an email to me stating which host is no longer working.</P> Tue, 22 May 2012 16:42:20 GMT matthewcanty 2012-05-22T16:42:20Z https://community.splunk.com/t5/Alerting/Alert-when-service-stopped-using-perf-mon/m-p/57506#M792 <P>source="Perfmon*" counter="% Processor Time" | chart last(Value) by _time, host</P> <P>How can I develop this search into an alert, which detects when a host has stopped sending perfmon events. </P> <P>I would like it to send an email to me stating which host is no longer working.</P> Tue, 22 May 2012 16:42:20 GMT https://community.splunk.com/t5/Alerting/Alert-when-service-stopped-using-perf-mon/m-p/57506#M792 matthewcanty 2012-05-22T16:42:20Z https://community.splunk.com/t5/Alerting/Alert-when-service-stopped-using-perf-mon/m-p/57507#M793 <P>If you have an index dedicated to perfmon, you might find metadata easier: </P> <P><PRE><CODE><BR /> | metadata type=hosts index=perfmon | where lastTime&lt;now()-900 <BR /> </CODE></PRE></P> <P>This search returns the machines that haven't reported anything in 15 minutes; I'm assuming the actual counter is irrelevant to you. You can adjust the time as required, but I wouldn't go much shorter or you'll get a bunch of false positives during reboots. Once you have the search tuned the way you want it, you can set up the alert as described in <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/SchedulingSavedSearches">http://docs.splunk.com/Documentation/Splunk/latest/User/SchedulingSavedSearches</A>.</P> Wed, 30 May 2012 21:01:17 GMT https://community.splunk.com/t5/Alerting/Alert-when-service-stopped-using-perf-mon/m-p/57507#M793 cphair 2012-05-30T21:01:17Z