Getting Data In

How to monitor inactive sourcetypes(or inactive indexes) in Splunk?

New Member

I need to create alert for inactive sourcetypes or index. All the logs are coming from a single host( a syslog server), so cannot create an alert based on host.

For using metadata command "type" is required but I am unable to set type as index or sourcetype
| metadata type=hosts | sort recentTime | convert ctime(recentTime) as Latest_Time

The following usecase helps me to get all the indexes and source types, but I am unable to set the time to check for the inactive requirement.
| tstats values(sourcetype) where index=* group by index

0 Karma
1 Solution

Builder

You have to use type=sourcetypes with metadata.

For sourcetypes that didn't report data in last 7 days -

| metadata type=sourcetypes | eval diff=now()-lastTime | where diff > 3600*24*7 | convert ctime(lastTime) | convert ctime(firstTime)  | convert ctime(recentTime) | sort -diff

View solution in original post

0 Karma

Builder

You have to use type=sourcetypes with metadata.

For sourcetypes that didn't report data in last 7 days -

| metadata type=sourcetypes | eval diff=now()-lastTime | where diff > 3600*24*7 | convert ctime(lastTime) | convert ctime(firstTime)  | convert ctime(recentTime) | sort -diff

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Alternatively have a look at metawoot this provides an enhanced metadata list in the form of a lookup file with more detail than the default metadata command...

0 Karma