Getting Data In

Log Flow Monitoring Solution (to detect broken/faulty feeds)

jonaclough
Path Finder

Has anyone had success in creating monitoring in Splunk to detect broken data feeds.

We have hundreds of feeds - some have events constantly coming in, some get data just once a month - and everything in between! We require a solution which would be smart enough to detect the pattern of events and alert when there is an anomaly. An anomaly might be a drastic reduction in events or a source which was previously sending events stopping

The best we've got so far is a simple alert that fires when a sourcetype has not had data for a fixed amount of time.

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

You can try Trackme app on Splunkbase. It has an option using machine learning to detect anomalies. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

You can try Trackme app on Splunkbase. It has an option using machine learning to detect anomalies. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...