Getting Data In

Log Flow Monitoring Solution (to detect broken/faulty feeds)

jonaclough
Explorer

Has anyone had success in creating monitoring in Splunk to detect broken data feeds.

We have hundreds of feeds - some have events constantly coming in, some get data just once a month - and everything in between! We require a solution which would be smart enough to detect the pattern of events and alert when there is an anomaly. An anomaly might be a drastic reduction in events or a source which was previously sending events stopping

The best we've got so far is a simple alert that fires when a sourcetype has not had data for a fixed amount of time.

Labels (2)
0 Karma
1 Solution

scelikok
Champion

You can try Trackme app on Splunkbase. It has an option using machine learning to detect anomalies. 

If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
Champion

You can try Trackme app on Splunkbase. It has an option using machine learning to detect anomalies. 

If this reply helps you an upvote is appreciated.

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!