Alerting

How to find out if splunk is indexing data?

irakeshraut
New Member

Hey guys,

I am new to splunk, started using it since yesterday. How can i find out if splunkd is indexing or not? Is it possible to find this information on terminal / web ?

I checked that my splunk is running by typing sudo service splunk status. But now I need to find out if its indexing or not.

Final Target: I want to send alert to scoutapp if splunkd is not indexing.

Thanks in advance.

0 Karma

kserra_splunk
Splunk Employee
Splunk Employee

To quickly check if splunk is indexing you can run the following search command from the search app in splunk web

index=*

This will show all data recently indexed by splunk. This includes internal splunk data as well so make sure that the data you want to monitor is present.

To setup alerts you will need to determine what data you want to alert on, then you can create a custom search/alert to alert if data stops coming in, below are a few previous splunk answers post which detail how to do this

http://answers.splunk.com/answers/9860/email-alert-when-a-data-source-dont-sends-events-to-splunk.ht...

http://answers.splunk.com/answers/3181/how-do-i-alert-when-a-host-stops-sending-data.html

https://answers.splunk.com/answers/37439/license-usage-monitoring-issue.html

irakeshraut
New Member

Can I search index=* using api ? I need to search for indexes tat happened in last 5 minutes only. How to do this using API?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>