Getting Data In

Sourcetype not reporting in Splunk query

anandhalagaras1
Contributor

Hi Team,

We have a requirement that is I have few of the sourcetypes configured from our end which contains very important logs. So if there are no logs from those particular sourcetypes then we need to get an alert for the same. So how should we need to configure the alert.

Hence kindly guide me with the search query for the same. i.e. The condition is that the search query would be running for every 15 minutes and it should trigger an alert if any of these sourcetypes are not sending logs to splunk for every 15 minutes.

Example:

index= windows sourcetype=dns

index=firewall sourcetype=syslog

index=os sourcetype=top etc.

So kindly help me with the query.

 

 

Labels (2)
0 Karma

rnowitzki
Builder

Hi @anandhalagaras1 

You already have what you need basically.

Go to settings -> Sarch, Reports and Alerts, click "new Alert" in top right.

As search you would put in for example index=windows sourcetype=dns
Make sure Alert Type is set to "Scheduled" and select "Run on Cron Schedule
Use this Cron Expression  */15 * * * *  (run every 15th minute).
As Time Range select "Last 15 Minutes".
As Trigger Condition set: "Number of Results" and "is equal to " 0.

At the bottom you can configure the kind of alert action you need (email, webhook posting, call the police...)

Hope this helps.
BR
Ralph

Edit:  Instead of returning all the Events, it would be better (from a performance/ressource usage pov) to run a stats command like:

index=windows sourcetype=dns | stats count

And  alert based on the count field.
So, once you have the alerting running, this would be a good point to optimize it.

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...