Re: Write a query that tracks log feeds - Splunk Community

Alerting

Write a Splunk query which will be saved as dashboard to determine if a log feed has stopped (log outage)

The sources are: access.log

sourcetypes: access_combined_wcookie

Would like include all your sources/sourcestypes per host?

————————————
If this helps, give a like below.

Get Updates on the Splunk Community!

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26 With threats moving at machine speed and attack surfaces expanding across hybrid ...

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us. The ...