https://community.splunk.com/t5/Splunk-Search/What-alert-search-can-I-use-to-check-and-alert-on-a-HF-not/m-p/522977#M147485 <P>Used this to find the HF's&nbsp;<BR /><BR />| set diff [search earliest="-30m" index=_internal host="*-splunk-hf"<BR />| dedup host<BR />| table host] [search earliest="-10m" index=_internal host="*-splunk-hf"<BR />| dedup host<BR />| table host]</P> Mon, 05 Oct 2020 12:17:08 GMT JTS911 2020-10-05T12:17:08Z https://community.splunk.com/t5/Splunk-Search/What-alert-search-can-I-use-to-check-and-alert-on-a-HF-not/m-p/522741#M147420 <P>Is there a heart beat from the HF I can monitor and if not detected, alert on it ?&nbsp;</P> Fri, 02 Oct 2020 19:48:18 GMT https://community.splunk.com/t5/Splunk-Search/What-alert-search-can-I-use-to-check-and-alert-on-a-HF-not/m-p/522741#M147420 JTS911 2020-10-02T19:48:18Z https://community.splunk.com/t5/Splunk-Search/What-alert-search-can-I-use-to-check-and-alert-on-a-HF-not/m-p/522742#M147421 <P>The Monitoring Console can do that for you.</P><P>There are a number of events you can use as a heartbeat.&nbsp; Search the internal index for one your forwarder's names to find them.</P> Fri, 02 Oct 2020 20:01:54 GMT https://community.splunk.com/t5/Splunk-Search/What-alert-search-can-I-use-to-check-and-alert-on-a-HF-not/m-p/522742#M147421 richgalloway 2020-10-02T20:01:54Z https://community.splunk.com/t5/Splunk-Search/What-alert-search-can-I-use-to-check-and-alert-on-a-HF-not/m-p/522977#M147485 <P>Used this to find the HF's&nbsp;<BR /><BR />| set diff [search earliest="-30m" index=_internal host="*-splunk-hf"<BR />| dedup host<BR />| table host] [search earliest="-10m" index=_internal host="*-splunk-hf"<BR />| dedup host<BR />| table host]</P> Mon, 05 Oct 2020 12:17:08 GMT https://community.splunk.com/t5/Splunk-Search/What-alert-search-can-I-use-to-check-and-alert-on-a-HF-not/m-p/522977#M147485 JTS911 2020-10-05T12:17:08Z