Multiple nodes of the same tier is not reporting in Splunk

[arvind_s]

Hi All,

index = XXX Sourcetype="YYY" host="ZZZ_IN_*" | stats count by host will display all the nodes which are up and running in the tier.

If any one ore two nodes are down, how can i create an alert for it.

Explaining about our problem: The nodes have both IIS and App logs which are stored in separate drives. Once the IIS logs are full also we will not receive an alert using metadata query, since splunkuniversal forwarder are capturing the logs from App logs. So we went for the above query but couldn't able to make out the result. Thanks in advance for your help.

Regards,
Parvathinathan CT

[richgalloway]

If you have a fixed number of hosts then you can compare that number to the number of responding hosts.

index = XXX Sourcetype="YYY" host="ZZZ_IN_*" | stats dc(host) as hosts | where hosts < 5 #or some other number

Of course, this doesn't tell you which host is missing.

Have you thought about creating an alert to let you know when disk space is almost full? Then you can react before it's too late and data is lost.