Alerting

How to create an alert based on these data assurance scenarios?

indianhans
Engager

Hi All,

I am seeking some thoughts to implement data assurance. I wish to build an alerting mechanism for following circumstances :

1) If a source stops sending the logs.
2) If there is any delay in Log indexing.
** 3) If the log format at source is changed. / Log pattern is changed.

Is there any easy solution to alert on above scenarios, especially Case 3 (Log pattern change).

Regards
Rishi

0 Karma
1 Solution

woodcock
Esteemed Legend

For the first 2, you should be able to find existing searches in your MC ( Settings -> Montioring Console ). Also for the 2nd one, you can track avg(_indextime - _time) over time by index, host, and sourcetype. For the last one, you need to track values(punct) or dc(punct) or | cluster | stats count over time by index, host, and sourcetype.

The cluster command is what drives the patterns tab:
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Cluster

View solution in original post

woodcock
Esteemed Legend

For the first 2, you should be able to find existing searches in your MC ( Settings -> Montioring Console ). Also for the 2nd one, you can track avg(_indextime - _time) over time by index, host, and sourcetype. For the last one, you need to track values(punct) or dc(punct) or | cluster | stats count over time by index, host, and sourcetype.

The cluster command is what drives the patterns tab:
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Cluster

indianhans
Engager

Thanks for your valuable inputs. I am already trying my hands on "Punct / Cluster". Can you please suggest some other ways, so that I can compare the results and accuracy ?

Thanks again. 🙂

0 Karma

woodcock
Esteemed Legend

Using punct is quick and dirty, using cluster is highly configurable and nuanced. Those are your options.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...