Archive
Highlighted

Feeds , index dashboard

Explorer

Is there a dashboard out here which can show the status of the indexes and feeds, health etc.?
I am looking particularly for feeds that don't come in on indexes or sourtypes, looking for thus for things that go wrong

Tags (1)
0 Karma
Highlighted

Re: Feeds , index dashboard

Contributor

Hi @ecanmaster,
You can also check status of your indexes in splunk monitoring console.
Also if you go to setting -> indexer clustering in your deployment server, you will get status of all your indexes.

Also you can check below splunk docs which explain what monitoring console can do.
https://docs.splunk.com/Documentation/Splunk/7.0.1/DMC/WhatcanDMCdo

0 Karma
Highlighted

Re: Feeds , index dashboard

Explorer

Unfortunatly, that's not what I need exaclty,

I need to know which index or source is inactive, offline (no data received) also need to know how many hosts are sending the data to the index/sourcetype , or even better which hosts are not sending data anymore to the index/sourcetype.

0 Karma
Highlighted

Re: Feeds , index dashboard

SplunkTrust
SplunkTrust

Then try this :

| tstats count where index=* by index sourcetype host | where count=0 

OR

index=* | stats count by index host | where count=0

Run this search for today And see which hosts are not sending data.
Keep the fields you want using | fields your_field Command
Let me know if this helps you

0 Karma
Highlighted

Re: Feeds , index dashboard

Communicator
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.