How to troubleshoot splunk data feed has been detected down:

[majilan1]

I'm working on splunk data feed outage alert:

The following data feed has been detected down:

Index=a  sourcetype=splunkd  host=b.

Is there someone can point me to the right direction of troubleshooting this issue.

Thanks a lot.

[isoutamo]

Hi

this is quite common question and you could found lot of answers to it by google/bing or what ever you want to use. Here is some links to you

SlackbotSlackbot

There are a lot of options for finding hosts or sources that stop submitting events:
Meta Woot! https://splunkbase.splunk.com/app/2949/
TrackMe https://splunkbase.splunk.com/app/4621/
Broken Hosts App for Splunk https://splunkbase.splunk.com/app/3247/
Alerts for Splunk Admins ("ForwarderLevel" alerts) https://splunkbase.splunk.com/app/3796/
Monitoring Console https://docs.splunk.com/Documentation/Splunk/latest/DMC/Configureforwardermonitoring
Deployment Server https://docs.splunk.com/Documentation/DepMon/latest/DeployDepMon/Troubleshootyourdeployment#Forwarde...Some helpful posts:
https://lantern.splunk.com/hc/en-us/articles/360048503294-Hosts-logging-data-in-a-certain-timeframe
https://www.duanewaddle.com/proving-a-negative/

r. Ismo