Deployment Architecture

Splunk Cloud - Heavy Forwarders : Not Sending logs

sting663
New Member

Hello there,

Is there any way to either configure an alert when the heavy forwarders are not sending logs in splunk cloud? Some sort of regime where it would routinely check to confirm that logs are being sent by the heavy forwarders as an automated process?

 

Many thanks

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sting663,

you could create an alert on Heavy Forwarder's Internal logs, to run e.g. every 5 minutes, that send an eMail if Splunk Cloud doesn't receive logs from the HF.

Something like this:

index=_internal host=HF_hostname

You could schedule this alert every 5 minutes that searches internal logs of the last 5 minutes.

Ciao.

Giuseppe

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.