Archive
Highlighted

Splunk alert for failing to read log files.

Engager

Is there an alert in Splunk or one we can set up that will alert us if Splunk hasn't read log files for more than 5 minutes.

Tags (2)
0 Karma
Highlighted

Re: Splunk alert for failing to read log files.

Contributor

Yes. You can create a alert for a search query as below:

host=yourhost earliest=-5m latest=now|stats count

0 Karma
Highlighted

Re: Splunk alert for failing to read log files.

Engager

Sanjay,

Thank you for that. Here is my final query. Since we have to monitor 10 production servers, I saved this and created an alert that looks for 10 hosts. If Splunk stops receiving logs from any of the 10, the alert notifies us and works perfectly.

host=web10 OR host=web11 OR host=web12 OR host=web13 OR host=web14 OR host=soa20 OR host=soa21 OR host=soa22 OR host=soa23 OR host=soa24 earliest=-5m latest=now | stats count(host) by host

Much appreciated.

View solution in original post

0 Karma