Getting Data In

Alert for syslog

asarolkar
Builder

I am trying to set an alert that notifies the admin of a situation when we dont get any data from syslog (no messages on udp:514) :

Alerts based on the following searches seem to be failing:

index=_internal (source=*/metrics.log* OR source=*\\metrics.log*) group=per_sourcetype_thruput series=syslog | eval flag= if(isnull(kb) OR len(kb)<=1,"Y","N") | table flag | search flag="Y"

sourcetype=syslog | timechart count span=1d | search count=0

Neither seems to be working out (there is no data written to that sourcetype which clearly one of the two ought to capture)

Any other/ideas suggestions ? I do not want to use deployment monitor (unless IN deployment monitor, there happens to be a way to configure an alert when it sees a missing sourcetype/no data from sourcetype ) ?

0 Karma
1 Solution

hjwang
Contributor

I think you can use a simple way to do this by searching source=udp:514

then set alert condition when number of events equals zero

View solution in original post

hjwang
Contributor

I think you can use a simple way to do this by searching source=udp:514

then set alert condition when number of events equals zero

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...