Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- How to monitor servers using splunk
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to monitor servers using splunk
I have been tasked with figuring out how to monitor server activity using splunk and create alerts
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For example, let's say that we have 10 servers that all run the same code. The traffic is load balanced and the code performs a process, that either completes successfully. At the end of the process there is a flag that is set such as "Successful = yes or no". There is also a couple of identifiers such as the vendor ie. "ABC Company" and then there is a unique "Process ID". This process is called real time 24/7. What I am looking for is an alert that will alert me (and others) when a certain threshold has been exceeded. For example, for ABC Company if the Successful = no count < 5 during a certain time period then no alert, but as soon as it goes over 5, then I am alerted.
I hope that this helped.
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First step is to collect the relevant data from the logs (I assume). The moment you have the data, you can work on the alerts.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That information is already being collected
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
maybe this video about creating alerts will help https://www.youtube.com/watch?annotation_id=annotation_2942967387&feature=iv&src_vid=SuARLqm7_jc&v=0...
Dave
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you provide more details on what you mean by "server activity"?
Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability for AI
