I want to set up an alert to notify when the master license server (one search head) goes down. What should I query for finding this out from an indexer that is pointing to it?
Check out: http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Aboutlicenseviolations#About_the_connection_be...
The following search should work: index="_internal" source="*splunkd.log" "failed to transfer rows"
Correction: Its index="_internal" source="*splunkd.log" "failed to send rows"
