Log Flow Monitoring Solution (to detect broken/faulty feeds)

[jonaclough]

Has anyone had success in creating monitoring in Splunk to detect broken data feeds.

We have hundreds of feeds - some have events constantly coming in, some get data just once a month - and everything in between! We require a solution which would be smart enough to detect the pattern of events and alert when there is an anomaly. An anomaly might be a drastic reduction in events or a source which was previously sending events stopping

The best we've got so far is a simple alert that fires when a sourcetype has not had data for a fixed amount of time.

[scelikok · Accepted solution]

You can try Trackme app on Splunkbase. It has an option using machine learning to detect anomalies.