Is there any alert if data integrity is compromised ?

[arber]

Hi,
We have enabled the data Integrity check for the indexes that we have on our splunk environment. As per the documentation we can execute the integrity check command from cli and see if there is any violation of the integrity for that index. Is there any alert that we can set up that automatically checks the integrity and notifies the users if something is changed ?

Thanks

[wrangler2x]

See https://answers.splunk.com/answers/452638/how-can-one-have-visibility-through-searches-of-da.html

[jdumont33]

Hello arber,

Splunk hasn't yet developped any automated alerting with the new Dataintegrity feature.
We deployed a script on our indexers that check the integrity of all indexes with the splunk cli command.
This script is called by inputs.conf once a day.
We have an alert monitoring this input.

To the best of my knowledge this is currently the only way of alerting when Dataintegrity checks fail.