Getting Data In

How to monitor inactive sourcetypes(or inactive indexes) in Splunk?

512anagha
New Member

I need to create alert for inactive sourcetypes or index. All the logs are coming from a single host( a syslog server), so cannot create an alert based on host.

For using metadata command "type" is required but I am unable to set type as index or sourcetype
| metadata type=hosts | sort recentTime | convert ctime(recentTime) as Latest_Time

The following usecase helps me to get all the indexes and source types, but I am unable to set the time to check for the inactive requirement.
| tstats values(sourcetype) where index=* group by index

0 Karma
1 Solution

dineshraj9
Builder

You have to use type=sourcetypes with metadata.

For sourcetypes that didn't report data in last 7 days -

| metadata type=sourcetypes | eval diff=now()-lastTime | where diff > 3600*24*7 | convert ctime(lastTime) | convert ctime(firstTime)  | convert ctime(recentTime) | sort -diff

View solution in original post

0 Karma

dineshraj9
Builder

You have to use type=sourcetypes with metadata.

For sourcetypes that didn't report data in last 7 days -

| metadata type=sourcetypes | eval diff=now()-lastTime | where diff > 3600*24*7 | convert ctime(lastTime) | convert ctime(firstTime)  | convert ctime(recentTime) | sort -diff
0 Karma

x3ncrypt
Loves-to-Learn Everything

Is there an equivalent search for indexes? Thanks

0 Karma

gjanders
SplunkTrust
SplunkTrust

Alternatively have a look at metawoot this provides an enhanced metadata list in the form of a lookup file with more detail than the default metadata command...

0 Karma
Get Updates on the Splunk Community!

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...