Alerting

How to find out if splunk is indexing data?

irakeshraut
New Member

Hey guys,

I am new to splunk, started using it since yesterday. How can i find out if splunkd is indexing or not? Is it possible to find this information on terminal / web ?

I checked that my splunk is running by typing sudo service splunk status. But now I need to find out if its indexing or not.

Final Target: I want to send alert to scoutapp if splunkd is not indexing.

Thanks in advance.

0 Karma

kserra_splunk
Splunk Employee
Splunk Employee

To quickly check if splunk is indexing you can run the following search command from the search app in splunk web

index=*

This will show all data recently indexed by splunk. This includes internal splunk data as well so make sure that the data you want to monitor is present.

To setup alerts you will need to determine what data you want to alert on, then you can create a custom search/alert to alert if data stops coming in, below are a few previous splunk answers post which detail how to do this

http://answers.splunk.com/answers/9860/email-alert-when-a-data-source-dont-sends-events-to-splunk.ht...

http://answers.splunk.com/answers/3181/how-do-i-alert-when-a-host-stops-sending-data.html

https://answers.splunk.com/answers/37439/license-usage-monitoring-issue.html

irakeshraut
New Member

Can I search index=* using api ? I need to search for indexes tat happened in last 5 minutes only. How to do this using API?

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...