https://community.splunk.com/t5/Splunk-Search/How-to-detect-when-a-server-has-stopped-indexing-logs-in-Splunk/m-p/285286#M86310 <P>What version of Splunk are you running? If it's version 6.3 you could use the DMC, if your a version lower than 6.3 then you could use this search and set up an alert </P> <PRE><CODE> index=_internal sourcetype=splunkd destPort!="-" | stats sparkline count by hostname, sourceHost, host, destPort, version | rename destPort as "Destination Port" | rename host as "Indexer" | rename sourceHost as "Forwarder IP" | rename version as "Splunk Forwarder Version" | rename hostname as "Forwarder Host Name" | rename sparkline as "Traffic Frequency" | sort - count </CODE></PRE> Thu, 07 Apr 2016 00:48:51 GMT skoelpin 2016-04-07T00:48:51Z https://community.splunk.com/t5/Splunk-Search/How-to-detect-when-a-server-has-stopped-indexing-logs-in-Splunk/m-p/285284#M86308 <P>I need to know what server(s) has stopped ingesting logs OR for which server the logs are not ingesting into Splunk. </P> <P>Thanks,</P> Wed, 06 Apr 2016 22:11:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-detect-when-a-server-has-stopped-indexing-logs-in-Splunk/m-p/285284#M86308 pandeyashish 2016-04-06T22:11:49Z https://community.splunk.com/t5/Splunk-Search/How-to-detect-when-a-server-has-stopped-indexing-logs-in-Splunk/m-p/285285#M86309 <P>Try this assuming that if no data is coming to splunk in 24 hrs(86400 sec) is your threshold.</P> <PRE><CODE>| metadata type=hosts index=* | eval age=now()-recentTime | where age&gt;86400 </CODE></PRE> Wed, 06 Apr 2016 23:51:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-detect-when-a-server-has-stopped-indexing-logs-in-Splunk/m-p/285285#M86309 somesoni2 2016-04-06T23:51:27Z https://community.splunk.com/t5/Splunk-Search/How-to-detect-when-a-server-has-stopped-indexing-logs-in-Splunk/m-p/285286#M86310 <P>What version of Splunk are you running? If it's version 6.3 you could use the DMC, if your a version lower than 6.3 then you could use this search and set up an alert </P> <PRE><CODE> index=_internal sourcetype=splunkd destPort!="-" | stats sparkline count by hostname, sourceHost, host, destPort, version | rename destPort as "Destination Port" | rename host as "Indexer" | rename sourceHost as "Forwarder IP" | rename version as "Splunk Forwarder Version" | rename hostname as "Forwarder Host Name" | rename sparkline as "Traffic Frequency" | sort - count </CODE></PRE> Thu, 07 Apr 2016 00:48:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-detect-when-a-server-has-stopped-indexing-logs-in-Splunk/m-p/285286#M86310 skoelpin 2016-04-07T00:48:51Z