Multiple nodes of the same tier is not reporting in Splunk

New Member

Hi All,

index = XXX Sourcetype="YYY" host="ZZZ_IN_*" | stats count by host will display all the nodes which are up and running in the tier.

If any one ore two nodes are down, how can i create an alert for it.

Explaining about our problem: The nodes have both IIS and App logs which are stored in separate drives. Once the IIS logs are full also we will not receive an alert using metadata query, since splunkuniversal forwarder are capturing the logs from App logs. So we went for the above query but couldn't able to make out the result. Thanks in advance for your help.

Parvathinathan CT

Labels (1)
0 Karma


If you have a fixed number of hosts then you can compare that number to the number of responding hosts.

index = XXX Sourcetype="YYY" host="ZZZ_IN_*" | stats dc(host) as hosts | where hosts < 5 #or some other number

Of course, this doesn't tell you which host is missing.

Have you thought about creating an alert to let you know when disk space is almost full? Then you can react before it's too late and data is lost.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: CFP Site: CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...