Getting Data In

New Forwarder Added

amN0P
Explorer

Is there a way of triggering an automated email alert whenever a NEW host(forwarder) starts sending logs to the Splunk Server.

Tags (1)
0 Karma
1 Solution

amN0P
Explorer

Thanks Vlad.

One more way of doing this..

| metadata index=index* OR index=main type=hosts | eval age = now()-lastTime | where age < 432000| sort age d | convert ctime(lastTime) | fields age,host,lastTime

Above search returns new forwarders added in the last 5 days.

View solution in original post

0 Karma

amN0P
Explorer

Thanks Vlad.

One more way of doing this..

| metadata index=index* OR index=main type=hosts | eval age = now()-lastTime | where age < 432000| sort age d | convert ctime(lastTime) | fields age,host,lastTime

Above search returns new forwarders added in the last 5 days.

0 Karma

reedmohn
Communicator

Doesn't this show all forwarders that have logged in the past 5 days?

0 Karma

Vladimir
Path Finder

Maybe it's not a right way but I used some similar query for alarm to check if I "lost" some hosts

index=my_index host earliest=-5m latest=now | dedup host | eval StatusBefore=1 | join type=left host [search index=my_index host earliest=-65m latest=-60m  | dedup host | eval StatusNow=1 ] | eval Status=if(StatusBefore=StatusNow,1,0) | table host, Status | where Status=0

This query do:

  • check available hosts for last 5 minutes
  • check available hosts for 5 minutes - 1 hour
  • compare two results (status = 1 - OK, status = 0 - new host)

Depending on your data polling interval you can set your own periods.

Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...