Dashboards & Visualizations

Is there a dashboard to monitor when event data is no longer being sent to Splunk from our hosts?

bluemarvel
Path Finder

Hello,

I am looking for a specific dashboard to detect when an event/log source is no longer sending events. The dashboard has to show and/or indicate with host is no longer sending events. I have something like this as an example, it of course does not work.

index=firewall host=servername | eval status=case (Count < 3,"Host Stopped Sending Data") | table host status Count  |  dedup  1 host  | sort  by status, count
0 Karma
1 Solution

sundareshr
Legend

If the firewall index has data from only one source, you could try this.

index=firewall | stats count by host | where count<3

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try (assuming threshold is time, like no data came in last 30 mins)

| metadata type=hosts index=firewall | where host="yourhostname" | eval status=case (recentTime<relative_time(now(),"-30m"),"Host Stopped Sending Data","All is well") | table host status totalCount
0 Karma

becksyboy
Communicator

Hi @somesoni2 when i try this, i get "Error in 'eval' command: The arguments to the 'case' function are invalid." do you know why this is the case?

0 Karma

becksyboy
Communicator

Thanks, some useful links here.

0 Karma

sundareshr
Legend

If the firewall index has data from only one source, you could try this.

index=firewall | stats count by host | where count<3
0 Karma

ddrillic
Ultra Champion

The improved DMC has the view of forwarders which haven't phoned home in the past hour/day, etc. Would it be good for you?

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...