Getting Data In

How to monitor servers using splunk

2powder
New Member

I have been tasked with figuring out how to monitor server activity using splunk and create alerts

0 Karma

2powder
New Member

For example, let's say that we have 10 servers that all run the same code. The traffic is load balanced and the code performs a process, that either completes successfully. At the end of the process there is a flag that is set such as "Successful = yes or no". There is also a couple of identifiers such as the vendor ie. "ABC Company" and then there is a unique "Process ID". This process is called real time 24/7. What I am looking for is an alert that will alert me (and others) when a certain threshold has been exceeded. For example, for ABC Company if the Successful = no count < 5 during a certain time period then no alert, but as soon as it goes over 5, then I am alerted.

I hope that this helped.

Thank you

0 Karma

ddrillic
Ultra Champion

First step is to collect the relevant data from the logs (I assume). The moment you have the data, you can work on the alerts.

0 Karma

2powder
New Member

That information is already being collected

0 Karma

davebrooking
Contributor
0 Karma

somesoni2
Revered Legend

Could you provide more details on what you mean by "server activity"?

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...