Alert for License Master Communication Error

[ips_mandar]

Hi,

I want to alert when there is communication error with license master.
I tried with index=_internal sourcetype=splunkd "failed to transfer rows*"
But want to know from splunk experts the query to know if there is any communication error.
Thanks,

[ekcsoc]

Hi,

What you are doing is correct.

Please find the below splunk documentation.

"To find out if a license slave has been unable to reach the license master, look for an event that contains failed to transfer rows in splunkd.log or in the _internal index."

Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Aboutlicenseviolations