Splunk alert for failing to read log files.

[travelcsa]

Is there an alert in Splunk or one we can set up that will alert us if Splunk hasn't read log files for more than 5 minutes.

[travelcsa · Accepted solution]

Sanjay,

Thank you for that. Here is my final query. Since we have to monitor 10 production servers, I saved this and created an alert that looks for 10 hosts. If Splunk stops receiving logs from any of the 10, the alert notifies us and works perfectly.

host=web10 OR host=web11 OR host=web12 OR host=web13 OR host=web14 OR host=soa20 OR host=soa21 OR host=soa22 OR host=soa23 OR host=soa24 earliest=-5m latest=now | stats count(host) by host

Much appreciated.

[sanjay_shrestha]

Yes. You can create a alert for a search query as below:

host=yourhost earliest=-5m latest=now|stats count