Getting Data In

New Forwarder Added

amN0P
Explorer

Is there a way of triggering an automated email alert whenever a NEW host(forwarder) starts sending logs to the Splunk Server.

Tags (1)
0 Karma
1 Solution

amN0P
Explorer

Thanks Vlad.

One more way of doing this..

| metadata index=index* OR index=main type=hosts | eval age = now()-lastTime | where age < 432000| sort age d | convert ctime(lastTime) | fields age,host,lastTime

Above search returns new forwarders added in the last 5 days.

View solution in original post

0 Karma

amN0P
Explorer

Thanks Vlad.

One more way of doing this..

| metadata index=index* OR index=main type=hosts | eval age = now()-lastTime | where age < 432000| sort age d | convert ctime(lastTime) | fields age,host,lastTime

Above search returns new forwarders added in the last 5 days.

0 Karma

reedmohn
Communicator

Doesn't this show all forwarders that have logged in the past 5 days?

0 Karma

Vladimir
Path Finder

Maybe it's not a right way but I used some similar query for alarm to check if I "lost" some hosts

index=my_index host earliest=-5m latest=now | dedup host | eval StatusBefore=1 | join type=left host [search index=my_index host earliest=-65m latest=-60m  | dedup host | eval StatusNow=1 ] | eval Status=if(StatusBefore=StatusNow,1,0) | table host, Status | where Status=0

This query do:

  • check available hosts for last 5 minutes
  • check available hosts for 5 minutes - 1 hour
  • compare two results (status = 1 - OK, status = 0 - new host)

Depending on your data polling interval you can set your own periods.

Get Updates on the Splunk Community!

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...

Enterprise Security Content Update (ESCU) | New Releases

In October, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...