Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Send email when application server/network dev...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
Is there a way for Splunk to send out an email notification when Splunk is not receiving any syslog entries from an application server or a network device?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, although you need to define some criteria. For example -
Search for hosts that have sent syslog events in the past week, but have not sent syslog events in the past hour.
Here is a search that would work:
sourcetype=*syslog* earliest=-7d
| fields host
| eval hcount = if (_time>=relative_time(now(),"-1h"),1,0)
| stats sum(hcount) as hourlyCount count as weeklyCount by host
| where hourlyCount == 0
You could then schedule this to run every hour and alert if number of events is greater than zero.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, although you need to define some criteria. For example -
Search for hosts that have sent syslog events in the past week, but have not sent syslog events in the past hour.
Here is a search that would work:
sourcetype=*syslog* earliest=-7d
| fields host
| eval hcount = if (_time>=relative_time(now(),"-1h"),1,0)
| stats sum(hcount) as hourlyCount count as weeklyCount by host
| where hourlyCount == 0
You could then schedule this to run every hour and alert if number of events is greater than zero.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks again for your help Iguinn!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, it's a typo. I've updated my original answer to fix it! Thanks for commenting and sorry about that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Iguinn,
I tried to run your command and it gives me the error:-
Error in 'eval' command: The arguments to the 'relative_time' function are invalid.
May I know how do i fix that?
I'm very sorry, I'm kinda weak in programming.
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
