Multiple nodes of the same tier is not reporting in Splunk

New Member

Hi All,

index = XXX Sourcetype="YYY" host="ZZZ_IN_*" | stats count by host will display all the nodes which are up and running in the tier.

If any one ore two nodes are down, how can i create an alert for it.

Explaining about our problem: The nodes have both IIS and App logs which are stored in separate drives. Once the IIS logs are full also we will not receive an alert using metadata query, since splunkuniversal forwarder are capturing the logs from App logs. So we went for the above query but couldn't able to make out the result. Thanks in advance for your help.

Parvathinathan CT

Labels (1)
0 Karma


If you have a fixed number of hosts then you can compare that number to the number of responding hosts.

index = XXX Sourcetype="YYY" host="ZZZ_IN_*" | stats dc(host) as hosts | where hosts < 5 #or some other number

Of course, this doesn't tell you which host is missing.

Have you thought about creating an alert to let you know when disk space is almost full? Then you can react before it's too late and data is lost.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...