which logs and how to check if data is written into Splunk.

[vikram_m]

our data in Splunk is differentiated based on Index. Now we need to se alert on index level whenever some index stops indexing data for more than 15min so that we can debug is there some thing wrong with getting particular data in.

[gcusello]

Hi vikram_m,
write a search like this one (e.g.: last hour)

index=* earliest=-h latest=now
| stats count by index
| where count < threeshold

where threeshold is an integer.

if you want to differentiate threeshold levels from each index, put them in a lookup (called e.g. filter.csv) with two fields (index
and threshold) and use it in your search:

index=* [ | inputlookup filter.csv | fields index ] earliest=-h latest=now
| stats count by index
| lookup filter.csv index  OUTPUT threeshold
| where count < threeshold

Bye.
Giuseppe