All Apps and Add-ons

Perfmon search - No data being received

marklehmann26
New Member

Hi All

Newbie splunk user here. I am wondering what the best search would be to alert on when trying to establish when an instance is not sending any perfmon data for a period of time say 10 mins and display the severity of the item within a table.

so far I have - index=client* sourcetype="Perfmon*" source=Perfmon:*

I may also just include the string to ignoreOlderThan 2 days so I can always be sure the data being queried on is fresh.

Thanks

Mark

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could run this every N minutes over a timerange of -2Nm to now:

your base search | stats max(_time) as latest by host | where latest < relative_time(now(), "-Nm")

Trigger the alert whenever there is a result. Note, I'm assuming the expected indexing delay to be much smaller than N minutes.

I'm not sure where you're getting a severity from.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...