https://community.splunk.com/t5/Splunk-Search/Event-for-when-a-log-host-or-source-fails/m-p/73336#M181086 <P>Is there a way to configure an event to fire when a certain log host or source fails to send logs after a given amount of time?</P> <P>Thanks.</P> Mon, 24 Jun 2013 15:19:31 GMT jasrich 2013-06-24T15:19:31Z https://community.splunk.com/t5/Splunk-Search/Event-for-when-a-log-host-or-source-fails/m-p/73336#M181086 <P>Is there a way to configure an event to fire when a certain log host or source fails to send logs after a given amount of time?</P> <P>Thanks.</P> Mon, 24 Jun 2013 15:19:31 GMT https://community.splunk.com/t5/Splunk-Search/Event-for-when-a-log-host-or-source-fails/m-p/73336#M181086 jasrich 2013-06-24T15:19:31Z https://community.splunk.com/t5/Splunk-Search/Event-for-when-a-log-host-or-source-fails/m-p/73337#M181087 <P>I don't think this is going to be possible, alerting works on taking searchable data and sending an alert about its contents. If splunk doesn't have data to search from, it can't send an alert.</P> Mon, 24 Jun 2013 15:24:42 GMT https://community.splunk.com/t5/Splunk-Search/Event-for-when-a-log-host-or-source-fails/m-p/73337#M181087 Antioch 2013-06-24T15:24:42Z https://community.splunk.com/t5/Splunk-Search/Event-for-when-a-log-host-or-source-fails/m-p/73338#M181088 <P>You could define a scheduled search that computes the number of events matching your criteria, and set an alert to trigger if that number is zero.</P> Mon, 24 Jun 2013 15:44:10 GMT https://community.splunk.com/t5/Splunk-Search/Event-for-when-a-log-host-or-source-fails/m-p/73338#M181088 martin_mueller 2013-06-24T15:44:10Z