Multiple nodes of the same tier is not reporting in Splunk

New Member

Hi All,

index = XXX Sourcetype="YYY" host="ZZZ_IN_*" | stats count by host will display all the nodes which are up and running in the tier.

If any one ore two nodes are down, how can i create an alert for it.

Explaining about our problem: The nodes have both IIS and App logs which are stored in separate drives. Once the IIS logs are full also we will not receive an alert using metadata query, since splunkuniversal forwarder are capturing the logs from App logs. So we went for the above query but couldn't able to make out the result. Thanks in advance for your help.

Parvathinathan CT

Labels (1)
0 Karma


If you have a fixed number of hosts then you can compare that number to the number of responding hosts.

index = XXX Sourcetype="YYY" host="ZZZ_IN_*" | stats dc(host) as hosts | where hosts < 5 #or some other number

Of course, this doesn't tell you which host is missing.

Have you thought about creating an alert to let you know when disk space is almost full? Then you can react before it's too late and data is lost.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...