Is there a dashboard out here which can show the status of the indexes and feeds, health etc.?
I am looking particularly for feeds that don't come in on indexes or sourtypes, looking for thus for things that go wrong
Try running broken hosts app
Then try this :
| tstats count where index=* by index sourcetype host | where count=0
OR
index=* | stats count by index host | where count=0
Run this search for today
And see which hosts are not sending data.
Keep the fields you want using | fields your_field
Command
Let me know if this helps you
Unfortunatly, that's not what I need exaclty,
I need to know which index or source is inactive, offline (no data received) also need to know how many hosts are sending the data to the index/sourcetype , or even better which hosts are not sending data anymore to the index/sourcetype.
Hi @ecanmaster,
You can also check status of your indexes in splunk monitoring console.
Also if you go to setting -> indexer clustering in your deployment server, you will get status of all your indexes.
Also you can check below splunk docs which explain what monitoring console can do.
https://docs.splunk.com/Documentation/Splunk/7.0.1/DMC/WhatcanDMCdo