How to set up an alert email to trigger if a heavy forwarder goes down in our environment?

Path Finder


i would like to setup an email alert if a heavy forwarder in our environment goes down. How do I do this?

0 Karma


If you know a set of hosts that should be sending data through that forwarder you can do a search like this:

host=xyz123 OR host=abc456 OR host=l12345 OR host=qwerty

Then save the search, setting the action of the search to alert if there are zero events in the time period that you find pertinent to the search. This means that if you get no events from your set of hosts, then it is probably not sending (working) and therefore down. If you have a period that is too short that you are looking at, then you might have a network hiccup that would cause an alert, or that there just wasn't enough data going into Splunk, so you would get a alert then, too. If you have too long a period of time then the search will take a while to run and slow everything down. We have several of these going that will check in a 5 minute window for any events, and if there are none, then it alerts the parties that can look at the data feed.

If you need more details, just let me know by commenting.

Splunk Employee
Splunk Employee

by going down you mean stops sending monitored data to the indexers?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...