Getting Data In

Alert for syslog

asarolkar
Builder

I am trying to set an alert that notifies the admin of a situation when we dont get any data from syslog (no messages on udp:514) :

Alerts based on the following searches seem to be failing:

index=_internal (source=*/metrics.log* OR source=*\\metrics.log*) group=per_sourcetype_thruput series=syslog | eval flag= if(isnull(kb) OR len(kb)<=1,"Y","N") | table flag | search flag="Y"

sourcetype=syslog | timechart count span=1d | search count=0

Neither seems to be working out (there is no data written to that sourcetype which clearly one of the two ought to capture)

Any other/ideas suggestions ? I do not want to use deployment monitor (unless IN deployment monitor, there happens to be a way to configure an alert when it sees a missing sourcetype/no data from sourcetype ) ?

0 Karma
1 Solution

hjwang
Contributor

I think you can use a simple way to do this by searching source=udp:514

then set alert condition when number of events equals zero

View solution in original post

hjwang
Contributor

I think you can use a simple way to do this by searching source=udp:514

then set alert condition when number of events equals zero

Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...