Email alert when a data source don't sends events to splunk


Is possible in splunk to configure no data alert? I want to receive an email alert when, for any reason, a data source don't sends events to my splunk server for a specified time.

Tags (1)


Yes, provided you can write a search that is specific enough to your data source. See:

0 Karma


The following search looks at all hosts in a given index and returns the ones that have not sent any data in the past 10 minutes (1200 seconds):

| metadata type=hosts index=blah |  convert ctime(recentTime) as Recent_Time | where lastTime < (now() - 1200) 

You could customize the 1200 to the interval of your choice, then schedule this search and set an alert condition, for example Number of results > 1 (which would fire when there are any hosts that haven't checked in in 1200 seconds).

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!