Splunk Cloud - Heavy Forwarders : Not Sending logs

[sting663]

Hello there,

Is there any way to either configure an alert when the heavy forwarders are not sending logs in splunk cloud? Some sort of regime where it would routinely check to confirm that logs are being sent by the heavy forwarders as an automated process?

Many thanks

[gcusello]

Hi @sting663,

you could create an alert on Heavy Forwarder's Internal logs, to run e.g. every 5 minutes, that send an eMail if Splunk Cloud doesn't receive logs from the HF.

Something like this:

index=_internal host=HF_hostname

You could schedule this alert every 5 minutes that searches internal logs of the last 5 minutes.

Ciao.

Giuseppe