topic Re: Index Not Reporting in Splunk Query in Reporting

Index Not Reporting in Splunk Query

anandhalagaras1 — Fri, 06 Dec 2019 14:35:18 GMT

Hi Team,

I would like to create a saved search in such a way that if any of the index is not reporting in Splunk for more than an hour then it should trigger an email with the index name information in it along with the last event came from that index.

Is there any query available so that i can schedule the same.

Re: Index Not Reporting in Splunk Query

anandhalagaras1 — Fri, 06 Dec 2019 14:57:07 GMT

Kindly help on the request.

Re: Index Not Reporting in Splunk Query

to4kawa — Sat, 07 Dec 2019 13:47:02 GMT

| metadata type=sourcetypes
| where recentTime <= relative_time(now(),"-1h")

Hi, @anandhalagarasan16021988
This query is aim to check sources has not been updated more than an hour.
you can change types(sources, hosts)

| tstats summariesonly=t  count where index=index1 OR index=index2 by index _time span=1h
| timechart cont=f count by index
| where _time <= relative_time(now(),"-1h")

This query also checks for an index that has not been updated.

Re: Index Not Reporting in Splunk Query

arjunpkishore5 — Sat, 07 Dec 2019 21:52:26 GMT

Try this.

| tstats latest(_time) as last_time, latest(_raw) as last_event by index earliest=-2h
| where (now()-last_time) > 3600

Re: Index Not Reporting in Splunk Query

woodcock — Mon, 09 Dec 2019 01:59:12 GMT

This has been solved many times including:
Meta Woot!: https://splunkbase.splunk.com/app/2949/
TrackMe: https://splunkbase.splunk.com/app/4621/,
Broken Hosts App for Splunk: https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts): https://splunkbase.splunk.com/app/3796/
Splunk Security Essentials(https://docs.splunksecurityessentials.com/features/sse_data_availability/): https://splunkbase.splunk.com/app/3435/
Monitoring Console: https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server: https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarder_warnings

Re: Index Not Reporting in Splunk Query

anandhalagaras1 — Fri, 13 Dec 2019 14:10:28 GMT

Hi arjunpkishore5,
Getting an error when i ran the query.
Error in 'tstats' command: Invalid argument: 'earliest=-2h'
The search job has failed due to an error. You may be able view the job in the Job Inspector.

Kindly check and let me know.