Write a query that tracks log feeds - Splunk Community

Alerting

Write a Splunk query which will be saved as dashboard to determine if a log feed has stopped (log outage)

The sources are: access.log

sourcetypes: access_combined_wcookie

Would like include all your sources/sourcestypes per host?

————————————
If this helps, give a like below.

Get Updates on the Splunk Community!

From Raw Data to Executive-Ready Stories, Faster

Build Data Stories for Every Audience A dashboard is rarely just a dashboard. It might be the view an ...

Guided Onboarding with Auto-schema Is Now Generally Available

We are excited to announce the General Availability of Guided Onboarding with Auto-Schematization ...

ATTENTION: We’re Moving! (AGAIN!)

The Splunk Community Slack is undergoing a system migration to keep our workspace secure and ...