New Forwarder Added

[amN0P]

Is there a way of triggering an automated email alert whenever a NEW host(forwarder) starts sending logs to the Splunk Server.

[amN0P · Accepted solution]

Thanks Vlad.

One more way of doing this..

| metadata index=index* OR index=main type=hosts | eval age = now()-lastTime | where age < 432000| sort age d | convert ctime(lastTime) | fields age,host,lastTime

Above search returns new forwarders added in the last 5 days.

[reedmohn]

Doesn't this show all forwarders that have logged in the past 5 days?

[Vladimir]

Maybe it's not a right way but I used some similar query for alarm to check if I "lost" some hosts

index=my_index host earliest=-5m latest=now | dedup host | eval StatusBefore=1 | join type=left host [search index=my_index host earliest=-65m latest=-60m  | dedup host | eval StatusNow=1 ] | eval Status=if(StatusBefore=StatusNow,1,0) | table host, Status | where Status=0

This query do:

• check available hosts for last 5 minutes
• check available hosts for 5 minutes - 1 hour
• compare two results (status = 1 - OK, status = 0 - new host)

Depending on your data polling interval you can set your own periods.