Getting Data In

Log Flow Monitoring Solution (to detect broken/faulty feeds)

jonaclough
Explorer

Has anyone had success in creating monitoring in Splunk to detect broken data feeds.

We have hundreds of feeds - some have events constantly coming in, some get data just once a month - and everything in between! We require a solution which would be smart enough to detect the pattern of events and alert when there is an anomaly. An anomaly might be a drastic reduction in events or a source which was previously sending events stopping

The best we've got so far is a simple alert that fires when a sourcetype has not had data for a fixed amount of time.

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

You can try Trackme app on Splunkbase. It has an option using machine learning to detect anomalies. 

If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

You can try Trackme app on Splunkbase. It has an option using machine learning to detect anomalies. 

If this reply helps you an upvote is appreciated.

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!