Monitor syslog Inputs

[JScordo]

I currently have a syslog server forwarding data to our splunk instance. I wanted to know if there were any searches that i could run to make sure these data sets coming in via syslog are always working. I have a search that runs for my windows boxes which checks the forwarders and that i'm not missing data from them. I was wondering if this was possible with my servers that are sending via syslog.

-Thank you

[sjohnson_splunk]

If you know the source names that you expect to see from the syslog server, you can easily use a metadata search and see what the lastTime value was for each source name. I like to use a regex filter to find only certain file names and then some time interval to wait.

| metadata type=sources index=* | regex source="" | eval lt=now() - lastTime | where lt>300

Schedule this to run on a 5 minute (or whatever) interval you need to check.