How to set up an alert email to trigger if a heavy forwarder goes down in our environment?

Path Finder


i would like to setup an email alert if a heavy forwarder in our environment goes down. How do I do this?

0 Karma


If you know a set of hosts that should be sending data through that forwarder you can do a search like this:

host=xyz123 OR host=abc456 OR host=l12345 OR host=qwerty

Then save the search, setting the action of the search to alert if there are zero events in the time period that you find pertinent to the search. This means that if you get no events from your set of hosts, then it is probably not sending (working) and therefore down. If you have a period that is too short that you are looking at, then you might have a network hiccup that would cause an alert, or that there just wasn't enough data going into Splunk, so you would get a alert then, too. If you have too long a period of time then the search will take a while to run and slow everything down. We have several of these going that will check in a 5 minute window for any events, and if there are none, then it alerts the parties that can look at the data feed.

If you need more details, just let me know by commenting.

Splunk Employee
Splunk Employee

by going down you mean stops sending monitored data to the indexers?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...