Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Send email when application server/network dev...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
Is there a way for Splunk to send out an email notification when Splunk is not receiving any syslog entries from an application server or a network device?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, although you need to define some criteria. For example -
Search for hosts that have sent syslog events in the past week, but have not sent syslog events in the past hour.
Here is a search that would work:
sourcetype=*syslog* earliest=-7d
| fields host
| eval hcount = if (_time>=relative_time(now(),"-1h"),1,0)
| stats sum(hcount) as hourlyCount count as weeklyCount by host
| where hourlyCount == 0
You could then schedule this to run every hour and alert if number of events is greater than zero.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, although you need to define some criteria. For example -
Search for hosts that have sent syslog events in the past week, but have not sent syslog events in the past hour.
Here is a search that would work:
sourcetype=*syslog* earliest=-7d
| fields host
| eval hcount = if (_time>=relative_time(now(),"-1h"),1,0)
| stats sum(hcount) as hourlyCount count as weeklyCount by host
| where hourlyCount == 0
You could then schedule this to run every hour and alert if number of events is greater than zero.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks again for your help Iguinn!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, it's a typo. I've updated my original answer to fix it! Thanks for commenting and sorry about that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Iguinn,
I tried to run your command and it gives me the error:-
Error in 'eval' command: The arguments to the 'relative_time' function are invalid.
May I know how do i fix that?
I'm very sorry, I'm kinda weak in programming.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Mile High Learning with Splunk University, Denver, Colorado
IT Service Intelligence 5.0 Series: Your Guide to the June Launch
Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0
