Getting Data In

Splunk forwarder stops working have to trigger email?

karthi2809
Contributor

One of my splunkforwarder is down last month .I am trying to find when the host is stop working .have to trigger alert when host is down.now i am using query that will check only 30 min .Can any one help on this.Thanks in advance

My query :
| metadata type=hosts index=XXX | eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status| where Status= "DOWN"

1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Hi @karthi2809,

This alert should work if all of your hosts are sending data at least every 30 minutes ( normally forwarders send data continuously at least for the _internal data). The difference is only in the "time range" you select to run this search. If you require to check hosts which are down for more than a month, then the time range also should be selected accordingly. However, once the alert is implemented, if any hosts goes down,then it should be notified there after.

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @karthi2809,

This alert should work if all of your hosts are sending data at least every 30 minutes ( normally forwarders send data continuously at least for the _internal data). The difference is only in the "time range" you select to run this search. If you require to check hosts which are down for more than a month, then the time range also should be selected accordingly. However, once the alert is implemented, if any hosts goes down,then it should be notified there after.

Happy Splunking!
0 Karma

karthi2809
Contributor

This alert is consolidated.so i have to show index in the table

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...