Getting Data In

Alert for syslog

asarolkar
Builder

I am trying to set an alert that notifies the admin of a situation when we dont get any data from syslog (no messages on udp:514) :

Alerts based on the following searches seem to be failing:

index=_internal (source=*/metrics.log* OR source=*\\metrics.log*) group=per_sourcetype_thruput series=syslog | eval flag= if(isnull(kb) OR len(kb)<=1,"Y","N") | table flag | search flag="Y"

sourcetype=syslog | timechart count span=1d | search count=0

Neither seems to be working out (there is no data written to that sourcetype which clearly one of the two ought to capture)

Any other/ideas suggestions ? I do not want to use deployment monitor (unless IN deployment monitor, there happens to be a way to configure an alert when it sees a missing sourcetype/no data from sourcetype ) ?

0 Karma
1 Solution

hjwang
Contributor

I think you can use a simple way to do this by searching source=udp:514

then set alert condition when number of events equals zero

View solution in original post

hjwang
Contributor

I think you can use a simple way to do this by searching source=udp:514

then set alert condition when number of events equals zero

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...