Archive

Alert for when new index/sourcetype is created

mr_t2083
New Member

What’s a good search query I can use to notify me any time a new index or sourcetype is created with a 7 day range.

Tags (1)
0 Karma
1 Solution

adonio
SplunkTrust
SplunkTrust

hello there,

partial answer here, indexes first.
here is how to check if an index was created, note: did not check in indexer cluster configuration but i assume its the same or close

index = _audit action=indexes_edit info=granted operation=create
| stats values(object) as new_index_created by _time splunk_server
| rename _time as creation_time splunk_server as indexer

as for sourcetype,
you can use the |metadata type=sourcetypes maybe with | outputslookup command to generate a lookup of sourcetype names and the last time they were seen by splunk and than have a search to run against new data and match to existing lookup table to see if there are any new sourcetypes

hope it helps

View solution in original post

0 Karma

adonio
SplunkTrust
SplunkTrust

hello there,

partial answer here, indexes first.
here is how to check if an index was created, note: did not check in indexer cluster configuration but i assume its the same or close

index = _audit action=indexes_edit info=granted operation=create
| stats values(object) as new_index_created by _time splunk_server
| rename _time as creation_time splunk_server as indexer

as for sourcetype,
you can use the |metadata type=sourcetypes maybe with | outputslookup command to generate a lookup of sourcetype names and the last time they were seen by splunk and than have a search to run against new data and match to existing lookup table to see if there are any new sourcetypes

hope it helps

View solution in original post

0 Karma

mr_t2083
New Member

Hi Adonio,

Thanks for your response, but I'm looking for a way to identify when new data is added to splunk. For example lets say sourcefire data is added and a new index called index=sourcefire is created. How can I get an alert when something new is added to splunk?

0 Karma

adonio
SplunkTrust
SplunkTrust

please refer back to the answer, the search above tells you when a new index was configured.
for sourcetypes, you can use the I metadata type=sourcetype command.
try it and see the result. you can capture a new sourcetype by the first and last field values that this command genarates

0 Karma

p_gurav
Champion

you can use | rest /services/data/indexes

0 Karma

mr_t2083
New Member

That just give me a list of index, I’m looking for a search that will give me a list of new index created in the last 7 days

0 Karma

aakwah
Builder

on the indexer run:

tail -f /opt/splunk/var/log/splunk/splunkd.log | grep index_name

then create and index and catch the log line, and you should find this log on _internal index

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on