Alert for lack of conent for one host

[ddrillic]

We have a case in which one index gets its content from 200 hosts and we would like to get an alert when one host hasn't sent content in the past hour or so.

One way might be to run a query like this one for the past month and join it with a similar query for the past hour and determine which hosts are missing -

index=<index_name> | stats count by host | sort count asc

Does it make sense?

[niketn · Accepted solution]

You should either use metadata or tstats which are more specific to scenarios like this and would perform better

metadata command will give you lastTime as one of the field for timestamp of Last Event received. You can use the same to come up with your alert.

| metadata type=hosts index=<YourIndexName>
| eval lastDataDuration=(now()-lastTime)/60
| where lastDataDuration>1

Similarly for tsats

| tstats count max(_time) as lastTime WHERE index=<YourIndexName> BY host
| eval lastDataDuration=(now()-lastTime)/60
| where lastDataDuration>1

[ddrillic]

Fascinating to see the results!!!!!