Splunk forwarder stops working have to trigger email?

[karthi2809]

One of my splunkforwarder is down last month .I am trying to find when the host is stop working .have to trigger alert when host is down.now i am using query that will check only 30 min .Can any one help on this.Thanks in advance

My query :
| metadata type=hosts index=XXX | eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status| where Status= "DOWN"

[renjith_nair · Accepted solution]

Hi @karthi2809,

This alert should work if all of your hosts are sending data at least every 30 minutes ( normally forwarders send data continuously at least for the _internal data). The difference is only in the "time range" you select to run this search. If you require to check hosts which are down for more than a month, then the time range also should be selected accordingly. However, once the alert is implemented, if any hosts goes down,then it should be notified there after.

[karthi2809]

This alert is consolidated.so i have to show index in the table