I would like to have an alert sent when my syslog server stops sending logs to the Splunk application. Because I am very new to Splunk can I get some examples please.
Very simple to write a search that you can set to trigger if the results are 0
| tstats count where index=your_syslog_index earliest=-2m@m latest=-1m@m
and then in your alert make it trigger on the custom trigger condition "search count = 0"
Note that if you have periods when you would not get syslog data for a minute, then it will trigger, so
Thanks Karma appreciate the quick response