Is there a dashboard out here which can show the status of the indexes and feeds, health etc.?
I am looking particularly for feeds that don't come in on indexes or sourtypes, looking for thus for things that go wrong
You can also check status of your indexes in splunk monitoring console.
Also if you go to setting -> indexer clustering in your deployment server, you will get status of all your indexes.
Also you can check below splunk docs which explain what monitoring console can do.
Unfortunatly, that's not what I need exaclty,
I need to know which index or source is inactive, offline (no data received) also need to know how many hosts are sending the data to the index/sourcetype , or even better which hosts are not sending data anymore to the index/sourcetype.
Then try this :
| tstats count where index=* by index sourcetype host | where count=0 OR index=* | stats count by index host | where count=0
Run this search for
today And see which hosts are not sending data.
Keep the fields you want using
| fields your_field Command
Let me know if this helps you