Getting Data In

Splunk forwarder stops working have to trigger email?

Communicator

One of my splunkforwarder is down last month .I am trying to find when the host is stop working .have to trigger alert when host is down.now i am using query that will check only 30 min .Can any one help on this.Thanks in advance

My query :
| metadata type=hosts index=XXX | eval age = now() - recentTime | eval status= case(age < 1800,"Running",age > 1800,"DOWN") | convert ctime(recentTime) AS LastActiveOn
| eval age=tostring(age,"duration") | eval host = upper(host)
| table host age LastActiveOn status
| rename host as "Forwarder Name", age as "Last Heartbeat(min)",LastActiveOn as "Last Active On",status as Status| where Status= "DOWN"

1 Solution

SplunkTrust
SplunkTrust

Hi @karthi2809,

This alert should work if all of your hosts are sending data at least every 30 minutes ( normally forwarders send data continuously at least for the _internal data). The difference is only in the "time range" you select to run this search. If you require to check hosts which are down for more than a month, then the time range also should be selected accordingly. However, once the alert is implemented, if any hosts goes down,then it should be notified there after.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi @karthi2809,

This alert should work if all of your hosts are sending data at least every 30 minutes ( normally forwarders send data continuously at least for the _internal data). The difference is only in the "time range" you select to run this search. If you require to check hosts which are down for more than a month, then the time range also should be selected accordingly. However, once the alert is implemented, if any hosts goes down,then it should be notified there after.

View solution in original post

0 Karma

Communicator

This alert is consolidated.so i have to show index in the table

0 Karma