Monitor whether network device is alive

[hjwang]

Can splunk do such this? Traditionally, it used ping, port scan or snmp. if the device is dead, it no longer sends log, how splunk detect such situation?Thanks

[mw]

To detect a device that's no longer sending events you could use something like this (from here😞

| metadata type=hosts | sort recentTime desc | convert ctime(recentTime) as Recent_Time | table host Recent_Time

However, the fact that events aren't being sent isn't necessarily an indication that a device is "dead". You could, however, easily create a scripted input to run ping/traceroute or whatever you like on a pretty tight interval and then create searches and alerts around the output, which would be a pretty standard way to deal with such issues and really the only reasonably reliable way that I know of.