Getting Data In

Splunk forwarder stops working have to trigger email?

karthi2809
Communicator

One of my splunkforwarder is down last month .I am trying to find when the host is stop working .have to trigger alert when host is down.now i am using query that will check only 30 min .Can any one help on this.Thanks in advance

My query :
| metadata type=hosts index=XXX | eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status| where Status= "DOWN"

1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @karthi2809,

This alert should work if all of your hosts are sending data at least every 30 minutes ( normally forwarders send data continuously at least for the _internal data). The difference is only in the "time range" you select to run this search. If you require to check hosts which are down for more than a month, then the time range also should be selected accordingly. However, once the alert is implemented, if any hosts goes down,then it should be notified there after.

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @karthi2809,

This alert should work if all of your hosts are sending data at least every 30 minutes ( normally forwarders send data continuously at least for the _internal data). The difference is only in the "time range" you select to run this search. If you require to check hosts which are down for more than a month, then the time range also should be selected accordingly. However, once the alert is implemented, if any hosts goes down,then it should be notified there after.

View solution in original post

0 Karma

karthi2809
Communicator

This alert is consolidated.so i have to show index in the table

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on