How to create an alert when CISCO IPS App is not collecting logs.

[integratednet]

Hi Folks

Can anybody advice how to create an alert when the Splunk CISCO IPS does not poll the data from the IPS device for more than 3 days?

Best regards
Muralee

[integratednet]

Hi

Thanks for the reply.

Being a beginner I would appreciate if you could provide me the complete syntax.

Best regards
Muralee,

[esix_splunk]

Can't write the complete search for you, but you can follow the splunk docs and can help you out a bit-

http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Metadata

Here is a base search that returns useful data, you can filter this down based on your sourcetype and host(s) of interest-

| metadata type=hosts index=_internal | rename totalCount as Count firstTime as "First Event" lastTime as "Last Event" recentTime as "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "First Event"=strftime('First Event', "%c") | fieldformat "Last Event"=strftime('Last Event', "%c") | fieldformat "Last Update"=strftime('Last Update', "%c")

[esix_splunk]

Quickest way would be via metadata. Check the latest time for your datasource, and if its > 3 days, you can fire and alert.

| metadata type=sourcetypes index=whereipsdatais | ......

Good luck.