Alerting

Alert for lack of conent for one host

Ultra Champion

We have a case in which one index gets its content from 200 hosts and we would like to get an alert when one host hasn't sent content in the past hour or so.

One way might be to run a query like this one for the past month and join it with a similar query for the past hour and determine which hosts are missing -

index=<index_name> | stats count by host | sort count asc

Does it make sense?

Tags (2)
0 Karma
1 Solution

Legend

You should either use metadata or tstats which are more specific to scenarios like this and would perform better

metadata command will give you lastTime as one of the field for timestamp of Last Event received. You can use the same to come up with your alert.

| metadata type=hosts index=<YourIndexName>
| eval lastDataDuration=(now()-lastTime)/60
| where lastDataDuration>1

Similarly for tsats

| tstats count max(_time) as lastTime WHERE index=<YourIndexName> BY host
| eval lastDataDuration=(now()-lastTime)/60
| where lastDataDuration>1
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Legend

You should either use metadata or tstats which are more specific to scenarios like this and would perform better

metadata command will give you lastTime as one of the field for timestamp of Last Event received. You can use the same to come up with your alert.

| metadata type=hosts index=<YourIndexName>
| eval lastDataDuration=(now()-lastTime)/60
| where lastDataDuration>1

Similarly for tsats

| tstats count max(_time) as lastTime WHERE index=<YourIndexName> BY host
| eval lastDataDuration=(now()-lastTime)/60
| where lastDataDuration>1
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Ultra Champion

Fascinating to see the results!!!!!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!