Alerting

Alert on Data Not Sending

PA-Lan-Tel
Observer

I would like to have an alert sent when my syslog server stops sending logs to the Splunk application. Because I am very new to Splunk can I get some examples please. 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Very simple to write a search that you can set to trigger if the results are 0

 

| tstats count where index=your_syslog_index earliest=-2m@m latest=-1m@m

 

and then in your alert make it trigger on the custom trigger condition "search count = 0"

Note that if you have periods when you would not get syslog data for a minute, then it will trigger, so 

0 Karma

PA-Lan-Tel
Observer

Thanks Karma appreciate the quick response 

0 Karma
Get Updates on the Splunk Community!

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...