Getting Data In

Log Flow Monitoring Solution (to detect broken/faulty feeds)

jonaclough
Path Finder

Has anyone had success in creating monitoring in Splunk to detect broken data feeds.

We have hundreds of feeds - some have events constantly coming in, some get data just once a month - and everything in between! We require a solution which would be smart enough to detect the pattern of events and alert when there is an anomaly. An anomaly might be a drastic reduction in events or a source which was previously sending events stopping

The best we've got so far is a simple alert that fires when a sourcetype has not had data for a fixed amount of time.

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

You can try Trackme app on Splunkbase. It has an option using machine learning to detect anomalies. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

You can try Trackme app on Splunkbase. It has an option using machine learning to detect anomalies. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...